How access works
- Roles group people by what they should be able to do, from full admin to read-only.
- Resource access governs which areas a role can reach.
- Field-level masking hides sensitive values (salaries, comp, customer-linked amounts) from roles that should not see them, while still letting them use the rest of the screen.
Masking in practice
When a value is masked for someone’s role, they see a clear “hidden for your role” state, not a misleading zero. This holds everywhere: tables, KPIs, reports, Nova answers, and exports.Access is enforced at the data layer, so masking cannot be bypassed by exporting, by Nova,
or by a custom report. The viewer’s permissions always apply.