User permissions 🔐

[FelixMalfait]

Currently, all users on a workspace have the same rights to create, edit, view and delete records.

In the future we want to provide a more granular role/permission system that lets an admin control who can edit workspace settings, but also setting object-level permissionning.

Example implementation on Hasura: https://hasura.io/docs/latest/auth/authorization/permissions/common-roles-auth-examples/
Other example: https://www.producthunt.com/posts/permit-io

Implementation

• Create a new table permissionSet within the metadata schema: nameSingular, labelSingular, isCustom, isAdmin
• Create a new table permissionSetAssignment with userWorkspaceId and permissionSetId
• Create a new table objectPermissions with permissionSetId, objectMetadataId, canRead, canCreate, canEdit, canDelete

Later we will create fieldPermissions and replace isAdmin by a more granular table with individual permissions.

Update

Note

We began developing permissions. ETA end of Q1.

twentyhq/core-team-issues#12

[skamensky]

Just for some community feedback, this is a blocker for us. We must be able to support permissions to be able to migrate to twenty.

See #501 (comment) for a related comment of mine.

[FelixMalfait]

Thanks @skamensky - that's a big lift so not coming soon unfortunately. But definitely on the roadmap and will get done

[estan]

We are exploring a migration to Twenty as well.

Just so I understand this current limitation: There's currently no way to restrict what a user can do e.g. in terms of altering the Data model of a workspace? If so, that would be a blocker for us as well, or at least a tough pill to swallow. That users have free reign to modify objects is something we could live with for a while, but letting everyone modify the data model itself would be a bit too much - people tend to get "creative" and carried away with such freedoms, even if you tell them not to, and we're a bit worried cleaning up unwanted model changes might become problematic..

[FelixMalfait]

@estan Yes that's correct. It's not the long term vision obviously but that's the current state.

[skamensky]

Understood, @FelixMalfait . Thanks for the reply.

In terms of permit-io, I just browsed their code and site and it looks like they don't support permissioning at the query level yet, which would make larger filtering either inefficient or insecure.

https://github.com/permitio/docs/blob/58384169b2786c02895abbec345cfe45668e68f4/docs/how-to/enforce-permissions/data-filtering.mdx?plain=1#L56-L67

[FelixMalfait]

Thanks! still a lot TBD. We were exploring relying on Postgres-level RLS but not sure we'll go that way

[bwmirek]

Any updates? Still blocker to implement this for real clients

[skamensky]

Looks like they're trying to hire someone to do this right now!

https://web.archive.org/web/20240829100144/https://www.ycombinator.com/companies/twenty/jobs/b1Uku7w-senior-software-engineer

Just posted today.

[hjpineda]

Hi all, this is also a blocker for us to move to Twenty. Is it possible to bump this priority up?

[FelixMalfait]

Hey @ijreilly and @Weiko are starting to work on this on Monday.
@ijreilly will work full time on this. We'll complete it by end of March.
(row level permissions probably not covered by this date but at least we'll have at least object-level / settings-permissions)

[ReessKennedy]

+1 ... I can use Twenty for organizing personal contacts but without solid permission control (and ability to hide some records from some users, like "hide all records with tag of finance") then we can't use for collaboration or team.

This feature feels, to me, like core to CRM and more important than automated Workflows given it seems clear this is a blocker for many with being able to use the CRM with their team? (Automatted workflow beta is amazing but just feel like in hierarchy of adoption, this one is more important.)

My only thought for achieving is multiple workspaces with the thought that these workspaces could be merged if/when this feature ships but not sure that is possible.

[FelixMalfait]

Hey thanks for the feedback! we're still on track for a v1 of permissions by end of March. We'll keep iterating in Q2 to make them more powerful (row-level permissions will come at the very end, prioritizing object level/ field level and settings permissions first)

[FelixMalfait]

#10159 (frontend only, backend not done)

[FelixMalfait]

V1 of permissions is now in production, it's very basic for now but followups will come in April/May to bring role creation, object-level/field-level permissions.

[raichubuilds]

Hello any update about role creation, object-level/field-level permissions?

[FelixMalfait]

Object level is code-complete. We are adding it to the Lab (public beta) next week and it will be out of the lab the following week (June 24 max). As for field-level it's planned but no date yet

[raichubuilds]

Thank you very much for your answer, one of the best crm I ever seen. Looking forward for new features 👍

[FelixMalfait]

Thank you!

[FelixMalfait]

Closing as object level is now complete and rolled-out. Field level permissions coming soon (should be end of July). Row-level not planned for this year.

[code1704]

Field level permissions coming soon (should be end of July)

Do we support this now?

[FelixMalfait]

By first half of August we will :)

[ReessKennedy]

@FelixMalfait ... congrats on getting first part out. I was hoping to move to Twenty but we just have one big DB at our current CRM and many of us have people and companies in us that are personal/only matter to us and need to be able to hide those. I am assuming that the news that row-level isn't schedule for this year means that won't be possible for hide a company, or group of companies tagged with X, for at least 2025? Or maybe I am overlooking. I have Twenty installed an am playing with it ... may try to keep using it as a personal CRM but if I can't hide companies or people based on rules, won't be able to migrate the team to it. Keep up the good work!

[FelixMalfait]

Yes unfortunately this is only something we will tackle in 2026! Top priorities for this semesters are AI, flexible layouts, dashboard/charts, better workflows, extensibility, and a lot of small iterations

[renatohr-spec]

We are considering to use Twenty, because of the vision and concepts, but if you could put something that can overcome that we are still missing row level permissions. Something for the "owners" of the objects, to support that owners of objects see just their objects. This will make simple teaming possible with every team member having visible just their oppties ... Until you build more deeper granularity ...

[SwiftPayments]

We are hoping row permissions will be added soon too. We would like to use the Account Owner field, so users can only see Companies they own (and Companies with no account ownership). This is the most important for us, but a bonus would be to also give us the flexibility to use any field on any object to determine the permission.

Another bonus would be to also apply settings such as edit and delete.

Then we can start thinking about hierarchy for sales managers to be able to only see Accounts Owned by their team.

[Bonapara]

Incoming very soon!

[SwiftPayments]

This is fantastic to hear - I have been trialling the system for a few days now and very impressed with the team's work! Certainly beats using a combination of Excel, Trello and OS navigation.

[Yeahguuy]

Running Twenty for a small business where personal contacts and professional contacts share the same workspace. The moment a second user is in, the private field is meaningless as a security boundary — they can filter it off, search past it, or browse All People.
Object-level permissions are solid progress. Field-level will help. But for anyone mixing personal and professional contacts in one workspace, row-level is the missing piece. A simple "owner-only" flag on a record — even without full predicate filtering — would cover most real use cases here.
Genuinely considering vibe coding this with Claude and submitting a PR if it stays on the back burner. Anyone else down that road?

[skamensky]

I don't think that would be a good idea since it's hardcoded to your use case and would introduce legacy permission notions for when full row level security is actually implemented.

[FelixMalfait]

Hey, row-level is available but it's on the Enterprise license today. You're welcome to do a fork to add whatever you need! It's unlikely we would merge something vibe-coded for something that is this close to the core :). Thanks!
Twenty is multi-tenant so one other option you have (no Enterprise license) is to create two workspace: one professional and one personal