Users & Permissions

Currently, we are only allowed just two main user roles—Admin and User. In our business model, we have sales reps who manage sensitive, high-net-worth clients. Some workw exclusively with these clients, and we need to ensure that only he and the admins can view and manage those particular contacts. On the other hand, we also have a broader group of salespeople who handle general incoming leads. These leads go into a user we created called "house account" and then i have an automation that assigns new contacts to that user. In that same automation, i add all the sales staff as contact followers so they can still be assigned tasks and see acitivy. While this workaround helps us, it also leads to intermittent issues and additional complexity. For instance, we recently had a scenario where a contact assigned to the house account had a task created that was assigned to a sales person (different user), but due to permission limitations, when the salesperson with the assigned task viewed his tasks screen from the contacts module, the associated contact field wasn’t visible to that rep. So there was no actionable way to conduct that task. Somehow that was eventually resolved on its own. Currently, contact followers cant see "house account" conversations, which created a big problem with one of our clients. It highlighted how fragile these workarounds can be. In other words, we’re relying on automations to manage workflows that would be much simpler if we had more nuanced user role permissions built into the platform. We are also sensitive to protecting a certain salesperson's contacts and have had staff in the past reassign contact ownership to themselves. Assigning the sales staff as followers allows them to see the contact, but not change the ownership, which currently works as a solution, but it is creating all the problems that i mentioned above. We believe that adding more granular permission controls, or allowing subaccounts to create their own user roles with more options for permissions with contact would benefit many businesses like ours. It would reduce the need for these complex workarounds and ensure a smoother experience.

Ability for admins, or at least agency owners, to see user activity (e.g. login, logout, WF updates, site updates, etc.). Important to see which users are engaged and which are dormant. Bonus: WF trigger on user engagement level, i.e. if a user's engagement level drops below x or rises above y, etc.

We have user's that would like to merge their contact but they don't have the ability to do so. Right now only the agency admin has this ability

Objective: Improve metric tracking, lead distribution, and internal communication among user groups within the platform. Current Problem: Currently, GHL only allows the addition of individual users without the ability to organize them into teams. This limitation impacts: Group Metrics: It’s impossible to analyze conversion rates, performance, or productivity by team (e.g., sales team vs. support team). Uneven Lead Distribution: Leads are assigned to individuals, not teams, which can overload some users while leaving others underutilized. Fragmented Communication: There’s no way to send targeted notifications to specific groups (e.g., alerts to the sales team about hot leads). Proposed Solution: Introduce a "Teams" feature within GHL, with the following functionalities: Team Creation Hierarchical Organization: Allow admins to create teams (e.g., "Sales SP", "24/7 Support") and assign users to multiple teams if needed. Customizable Permissions: Define access levels by team (e.g., sales team can edit pipelines, marketing team can only view reports). Team Metrics Custom Dashboard: View total conversion by team (e.g., how many leads from Team X became customers). Compare performance between teams (close rates, response times, etc.). Filter reports by team for strategic analysis. Automatic KPIs: Generate metrics like "Team Conversion Rate" or "Leads Assigned per Team" in charts and tables. Lead Distribution to Teams Automated Rules: Distribute leads evenly among team members (e.g., round-robin). Prioritize teams with lighter workloads or higher conversion rates. Assign leads based on tags or specific criteria (e.g., SP leads → SP sales team). Workload Balancing: Prevent overload by monitoring how many leads each team is handling. Internal Notifications by Team Targeted Alerts: Send real-time notifications to entire teams (e.g., "New urgent lead for the sales team"). Integrate with channels like Slack, email, or push notifications within GHL. Automated Reminders: Notify teams about pending tasks (e.g., follow-ups for unattended leads). Strategic Importance for GHL: Scalability: Larger businesses need to manage multiple teams without losing the big-picture view. Decision-Making: Team metrics help leaders identify gaps and reallocate resources effectively. Customer Experience: Evenly distributed leads are attended to faster, boosting satisfaction. Competitiveness: Platforms like HubSpot and Salesforce already offer this feature – GHL needs to keep up. Example Use Case: A marketing agency with 3 teams (Sales, Onboarding, Support) would use GHL to: Measure which team converts the most leads into meetings. Distribute 100 leads/day evenly among 10 sales reps. Send an automatic alert to the support team when a client opens a critical ticket. Technical Implementation Suggestion: Simple UI: Add a "Teams" section in the settings menu, with drag-and-drop user assignment. APIs for Automation: Allow teams to be used in workflows (e.g., "Send lead to Team X if tag is Y"). Integration with Existing Features: Link teams to pipelines, calendars, and campaigns. Why This is Urgent: Businesses are migrating to GHL for its flexibility, but the lack of team management limits its use for medium/large organizations. This feature would transform GHL into a truly competitive all-in-one platform.

Short Summary: We need a customizable "Support Specialist" agency role that grants global access to all sub-accounts by default, but allows admins to selectively enable or disable specific Agency-level tabs per user. This role must also include strict account exclusions or warning popups for sensitive/PHI data, backed by a comprehensive QA change log. The Problem: As agencies scale, we hire support employees who need to "stay in their lane." Currently, GHL's permission structure fails us in two major ways: Data Exposure: To allow a support agent to see the global list of sub-accounts and jump in to help clients, we have to give them Agency-level access. However, this exposes highly sensitive agency-level information (billing, agency revenue, internal settings, marketplace purchases). Support employees should never see how the agency itself operates financially. "All-or-Nothing" Permissions: We cannot customize what an agent can see at the Agency level. We can't let them look at the Sub-Accounts tab while completely hiding the Billing or Marketplace tabs. Proposed Solution: Absolute Agency Isolation (By Default) The Support Specialist role must be completely blind to sensitive Agency-level data by default. They should not see Agency Billing, Agency Settings, Team Management, SaaS Configurator, or Marketplace, keeping their primary focus strictly on navigating and accessing sub-accounts. Granular, Per-User Agency Tab Toggles Within the Team Management settings, Admins should be able to toggle specific Agency-level tabs on or off per support user. For example, an admin can enable the "Sub-Accounts" tab so the agent can see the global list and jump into any account to solve a ticket, while keeping "Billing" and "SaaS Configurator" completely hidden. Selective Account Exclusions & HIPAA Safeguards To protect client privacy, admins need a way to manage access to sensitive accounts. We propose two options: Exclusion Toggle: A simple checklist to "Exclude Access" to specific sub-accounts from that agent's global list. HIPAA/PHI Gate: A mandatory confirmation pop-up that appears when an agent attempts to enter a designated sensitive account (e.g., "Warning: This is a HIPAA-compliant account containing PHI. Do you have authorization to enter?"), which is then tracked. Robust QA Audit Logs A dedicated agency-level change log tracking actions taken specifically by these support users. To protect the business and maintain Quality Assurance, admins must be able to see: Who made the change, when, in which sub-account, and what exact setting/workflow was modified. Why This Benefits the GHL Community: Internal Security: Prevents employee data-theft, accidental deletion of critical agency assets, and exposure of confidential agency financials. Operational Flexibility: Allows agency owners to safely hire support teams to manage high-volume ticketing across all accounts without giving away the keys to the kingdom. Compliance: Gives agencies the precise control and audit trails required to sign enterprise clients and maintain strict HIPAA compliance.

Whilst the recent enforcement of 2FA (via email) is a welcome addition to the security of High-Level, email based 2FA is unfortunately one of the least secure 2FA methods. So, please add more 2FA options. Including at a minimum TOTP codes (a global standard) that people can use through whatever TOTP App they use. (E.g. Authy, Duo, Google Authenticator, Microsoft Authenticator etc). And at the same time, please: Allow an agency to select what 2FA options they will allow to be used across their clients. Allow Admins of a sub-account to also have this level of functionality to select what 2FA options users in their Sub-Account can use IF the Agency gives it to them.

Have a feature where you can enable/disable notification for Agency Owners or a specific users when a new user is created.

If we could create a custom field for team members (users) this would be MASSIVE. Means we can have way more flexibility in cycling users in campaigns (dynamically insert more things other than phone, email, signature, calendar).For example, this would also solve the problem I submitted in these ideas: https://ideas.gohighlevel.com/ideas/HIGHLVL-I-1308https://ideas.gohighlevel.com/ideas/HIGHLVL-I-1253A custom field for 'custom user calendar' would solve both of these. This is also a pathway to round robin cycling through calendars - the round robin would be done at the point they enter the campaign! HIGHLVL-I-1330

Current: each user permissions are managed individually. Expected: enterprise software should have Role Groups, allow managing permissions based on which group the user belongs to. This saves time managing users/permissions and prevents unintended access being granted to the wrong users. For example, if we enable a new feature and want to give access to 100 users, right now it requires editing permissions for 100 users 1-by-1. Extremely inefficient.