Your team stops working around permissions when the permissions match how they work. Each person should see and edit exactly the records their job needs, set by rules on the record itself rather than by which file, folder or tab they can open.
Make access too broad and sensitive data travels further than it should. Make it too tight and people export to spreadsheets or share logins just to finish their day. The fix is record-level rules, enforced on the server, that your own team can adjust as roles change.
Open access works until the team outgrows it
The fastest way to test your permissions is to ask how many customer exports are sitting in people's download folders right now. If the answer makes you wince, the rules aren't the problem people think they are.
Shared access gets a lot right. When five people run a business together, one spreadsheet or one shared drive everyone can open is quick, flexible and needs no admin. Nobody waits for approval, and everybody sees the full picture.
The trouble starts with the tenth hire, the first freelancer or the first partner who needs to see one project and nothing else. At that point "everyone sees everything" stops being trust and starts being risk, and most teams swing straight to the other extreme.
People route around rules that block their work
Locking everything down feels safe, but it rarely stays that way. A CyberArk survey of more than 14,000 office workers, reported by Help Net Security, found that 65% had found ways around cybersecurity policies to get their work done. In a separate KnowBe4 study covered by TechRadar, half of the 435,000 employees surveyed said they regularly use unapproved services to do their jobs.
Those people aren't villains. When the official system says no and the deadline says yes, they take the path of least resistance. A sales rep who can't see the invoice status asks finance to email a PDF. A project lead who can't add a contractor shares their own login. Each workaround solves today's problem and opens a new one nobody is tracking.
Good permissions follow the record, not the file
Here is the distinction that ends the workarounds. File and folder permissions answer one blunt question: can this person open this thing? Record-level permissions answer the question your business is asking: should this person see this customer, this invoice, this project?
In practice, that looks like a set of rules that read like your org chart. A sales rep sees their own accounts, while a regional manager sees every account in their region. Finance sees invoice amounts that the field team never needs. A service technician can update a job's status but not its price. An external partner sees the two projects they're working on, without anyone handing them the keys to the kingdom.
Off-the-shelf tools usually give you a handful of fixed roles and leave the rest to luck. Custom database software lets you write the rule your business needs, down to a single field on a single record. When the rule fits, nobody needs a workaround.
Rules your team can read, change and trust
Ninox is an AI-native low-code platform that can build custom database software, and permissions are part of the data model from the first table. At table level, conditions like "Can read if", "Can edit if", "Can create if" and "Can delete if" decide who can do what with each record. At field level, separate read and edit access rules let you hide a salary or lock a price while the rest of the record stays open.
Those rules can use real logic, so a record can be visible to the person who created it, to anyone with a manager role, or to whoever is assigned to that project. They're enforced on the server, so they apply however someone reaches the data, whether through a page, a view or the REST API. API keys carry their own scoped permissions instead of full workspace access, and admins decide whether Ninox AI may access records at all, which is switched off by default.
Because Ninox is a low-code platform, the people who understand the roles can maintain the rules. When a freelancer joins or a manager changes regions, you update a condition in minutes instead of waiting for a developer. Users can see every device they're signed in on and sign out everywhere at once, and Ninox is GDPR compliant and ISO 27001 certified.
The circle of people who need access keeps widening
Permissions matter more every year because more people outside your company touch your data. Verizon's 2025 Data Breach Investigations Report, which analysed 12,195 confirmed breaches, found that the share involving third parties doubled to 30%. Every partner, freelancer and supplier you share data with is a reason to know exactly what each of them can see. The teams that stay ahead are the ones whose custom database software makes the right access the easy option, built on a low-code platform they can adjust as fast as the business changes.
Take the next step.
