TeamPulse RBAC: Admin, Manager & Rep Role Access Control

In high-performance sales environments, data relevance and security are paramount. TeamPulse RBAC in SuiteCRM ensures the right insights reach the right people by enforcing SuiteCRM’s native role hierarchy at the server level. This eliminates data noise by filtering complex behavioral metrics into actionable views tailored to each user’s rank and responsibility.

TeamPulse identifies roles through the detectRole() function, which classifies users into three distinct tiers: Admin, Manager, and Rep.

Admin View: Full Access and Configuration

The Admin role is assigned to users with is_admin=1 in SuiteCRM. This tier provides an unrestricted view of the entire organization.

• Data Scoping – Access to all teams, all reps, and all historical data.
• UI Visibility – Admins see all navigation groups, including the Admin section (Actions, Journal, Export, and Settings).
• Settings Control – Full access to all Settings tabs, including sensitive areas like AI & Data (API keys) and Debug (system logs and data audits).
• Key Capability – Ability to configure global scoring weights, manage license activation, and run system-wide diagnostics.

Manager View: Team Scoping and Coaching

The Manager role is dynamically detected for users who have at least one direct report assigned via the reports_to_id field in SuiteCRM. There is no separate “Team Lead” role in v0.9.9 – any user with direct reports is classified as a Manager regardless of title.

• Data Scoping – Operations are auto-scoped to show only the manager’s direct reports. Managers cannot view data for teams or reps outside their hierarchy.
• UI Visibility – Managers see most navigation groups except system-level admin tools.
• Settings Access – Managers are restricted to the General, Schedule, and Support tabs. They are blocked from accessing Scoring Rules, AI & Data, and Debug logs.
• Coaching Tools – Full access to the Coaching Journal and the Actions hub to send alerts, kudos, or coaching notes to their team.

Rep View: Self-Performance Monitoring

Any user who is not an admin and does not have direct reports is classified as a Rep.

• Data Scoping – Limited strictly to a “Self-View.” Reps cannot see team-wide leaderboards or the performance data of their peers.
• UI Visibility – The sidebar is filtered to show the My Work group only. Access to the Dashboard and Analytics groups is restricted.
• My Performance View – A dedicated screen where the rep sees their own score ring, five-factor breakdown, and any coaching notes received from their manager.
• Anonymized Benchmarking – Reps can compare their performance against an anonymized “Top Performer” to identify behavioral gaps without compromising team privacy.

Role Access Summary

Note: “Team Lead” is not a distinct code role in v0.9.9. Any user with direct reports is detected as a Manager regardless of their CRM title.

Score Bands Reference

Regardless of role, scores displayed across all views use the following bands:

How to Configure RBAC

The RBAC system operates automatically based on your SuiteCRM configuration. Administrators must ensure the hierarchy is correctly mapped before first use.

1. Map the Hierarchy – In SuiteCRM Admin ? User Management, ensure every Rep has the correct manager assigned in the Reports To field. TeamPulse uses reports_to_id to resolve team members and scope data.
2. Verify Role Detection – Users can confirm their detected role at the bottom of Settings ? General under System Information. The /ping API endpoint also returns the tp_role currently assigned to the session.
3. Interact with Role-Filtered Navigation:
   • Managers – Use the Team Selector dropdown in the top bar. It displays only teams that contain your direct reports.
   • Reps – Navigate to My Performance to review signals and acknowledge coaching notes from your manager.
4. Server-Side Scoping – No manual intervention is required for security. TeamPulse enforces data scoping at the server level. If a Rep attempts to access a Manager-level URL (e.g., the Leaderboard), the router guard automatically redirects them to their Self-View.

[Image Placeholder: Manager View – Team Dashboard with scoped member tiles and Team Selector dropdown]

[Image Placeholder: Rep View – Personal Discipline Score ring and five-factor breakdown]

[Image Placeholder: Admin View – Debug and Audit tabs visible in Settings sidebar]

Next Steps

• Review Direct Reports – If the Health Scorecard shows a rep in the Critical band (0-49), drill down into their specific signals.
• Intervene on Stale Deals – Use the Deal Hygiene Monitor to identify which direct reports have deals with no next steps.
• Send Coaching Notes – Use the Actions tool to send a specific coaching note to a rep regarding a behavioral decline.
• Acknowledge Progress – Send “Kudos” to reps showing “Growing” momentum to reinforce positive behavioral trends.

Troubleshooting / FAQ

Q: Why can’t a manager see their team members in the Leaderboard?
A: This usually indicates that reports_to_id is not set correctly in SuiteCRM. Ensure the manager is correctly assigned in Admin ? User Management.

Q: Can a Rep see other reps’ scores or team revenue?
A: No. TeamPulse enforces server-side scoping. Reps are restricted to the RepSelfView (My Performance) and cannot access team-wide data or financial metrics.

Q: What happens if an Admin is also a Manager?
A: The system prioritizes the Admin role (is_admin=1). The user sees all teams while still maintaining full access to coaching tools for their direct reports.

Q: Why does the Settings page only show three tabs for me?
A: If you only see General, Schedule, and Support, you are logged in as a Manager. Access to Scoring Rules, AI & Data, and Debug is restricted to the Admin role to prevent unauthorized changes to the intelligence engine.