Teams and Permissions Overview

How Permissions Work

TrackDrive controls access through three cooperating layers:

1. Team: defines what a group of users can see and do. Each team stores per-model access grants that specify which models are enabled, which fields are readable or updatable, and which specific record IDs are accessible.

2. Superuser Access: a team can grant superuser status to its members. Superusers bypass most permission checks but may still be scoped by a list of permitted application areas (e.g., analytics, billing, setup). Company owners and administrators bypass these area restrictions entirely.

3. Field-Level Access Control: provides column-level access control. When a record is accessed by a non-superuser, the system checks the user's permissions before returning each field value. Unauthorized fields are hidden from the response.

How They Interact

A superuser bypasses field-level restrictions and most permission checks. For non-superusers, the request must pass the team permission check (does the user's team grant access to this model and action?), and then field-level control limits which columns are visible in the response.