> For the complete documentation index, see [llms.txt](https://surecloud.gitbook.io/surecloud-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://surecloud.gitbook.io/surecloud-docs/documentation/admin/managing-user-access-to-records.md).

# Managing User Access to Records

Learn how roles, groups, and hierarchy context control access to records in SureCloud.

User access to records depends on both permissions and hierarchy context.

Users need the right [Roles](/surecloud-docs/documentation/admin/managing-user-access-to-records/roles.md), the right [Groups](/surecloud-docs/documentation/admin/managing-user-access-to-records/groups.md), and access to the right [Hierarchy](/surecloud-docs/documentation/admin/managing-user-access-to-records/hierarchy.md) context.

{% hint style="info" %}
A user must have both the required permission and access to the record's hierarchy context.
{% endhint %}

### How record access works

Record access is controlled by three things:

* **Roles** define what a user can do.
* **Groups** assign those roles to users.
* **Hierarchy context** limits which records the user can access.

If one of these is missing, the user may not be able to view or update the record.

### Roles

Roles define what actions a user can perform in SureCloud.

Roles can include:

* **System permissions** for platform features
* **Entity permissions** for Create, Read, Update, and Delete access on specific record types

Use roles to control the level of access a user needs for their job.

### Groups

Groups are collections of users.

Roles are assigned to groups, and users inherit the roles from the groups they belong to.

This makes access easier to manage at scale.

In some setups, a new hierarchy item also creates a group with the same name.

Managing membership of these groups helps control access to records linked to specific hierarchy nodes.

For more information, see [Groups](/surecloud-docs/documentation/admin/managing-user-access-to-records/groups.md).

### Hierarchy context

Records can be assigned to a hierarchy context.

This limits access to users who belong to the relevant hierarchy node or nodes.

Even if a user has the correct role, they may still be unable to access a record if they do not have the right hierarchy access.

For more information, see [Hierarchy](/surecloud-docs/documentation/admin/managing-user-access-to-records/hierarchy.md).

### Review or change a user's access

If a user cannot access a record, check these areas in order:

{% stepper %}
{% step %}

### Check the user's groups

Confirm the user is a member of the correct group or groups.
{% endstep %}

{% step %}

### Check the group's roles

Review the roles assigned to those groups.

Make sure the roles include the required entity permissions.
{% endstep %}

{% step %}

### Check the record context

Confirm the record is assigned to the expected hierarchy context.
{% endstep %}

{% step %}

### Update access if needed

Update the user's group membership or the roles assigned to those groups.

Avoid granting access case by case where a role or group update would solve it.
{% endstep %}
{% endstepper %}

For more information, see [Roles](/surecloud-docs/documentation/admin/managing-user-access-to-records/roles.md) and [Users](/surecloud-docs/documentation/admin/managing-user-access-to-records/users.md).

### Best practices

* Follow the principle of least privilege.
* Use groups to manage access instead of handling users one by one.
* Review roles, groups, and hierarchy settings regularly.
* Check both permissions and hierarchy when troubleshooting access.

If you still need help, contact your SureCloud administrator.