GoHighLevel User Roles and Permissions: Give Staff the Access They Need and Nothing More (2026 Guide)
Last updated: October 2026.
GoHighLevel user roles and permissions decide who can see your contacts, edit your workflows and change your settings. Most Australian businesses and agencies set them once, give everyone Admin "to save time", and only find out what that costs when a workflow is deleted or a client list walks out the door.
Some links below are affiliate links — if you sign up through them, Pivot 2 Thrive may earn a commission at no extra cost to you. It never changes what we recommend.
Key takeaway: Give every staff member the User role, switch on only the modules they use, and limit sales and support staff to their assigned contacts. Keep Admin for one or two named owners, turn on two-factor authentication, and review access every quarter and whenever someone leaves.
On This Page
This guide is written by Dr Priya Jaganathan, Go High Level Certified Admin, Certified AI Tech Stack Consultant and keynote speaker, who builds AI and automation systems for Australian businesses and agencies at Pivot 2 Thrive.
What GoHighLevel user roles actually are
GoHighLevel user roles are the access levels that control what each person can do inside an agency account or a sub-account. Every user has a type (agency or account) and a role (Admin or User).
An Admin in a sub-account can do everything. A User can only reach the modules you tick on their permission screen — contacts, conversations, opportunities, calendars, marketing, workflows, settings and so on.
On top of the module toggles, you can restrict a User to only their assigned data. That one switch is the difference between a junior seeing their own 40 leads and seeing your entire 12,000-contact database.
Why loose GoHighLevel permissions cost more than you think
Most data problems are not hackers. They are people with more access than they need, having a bad day.
According to the OAIC's Notifiable Data Breaches statistics for January to June 2025, human error caused 37% of all notified breaches (193 of 532 notifications), up from 29% in the previous period. Misdirected emails, wrong recipients and accidental disclosures sit in that bucket.
In a CRM, the same pattern shows up as a bulk SMS sent to the wrong smart list, a workflow edited live, or a former contractor still logged in three months later. Tight permissions shrink the blast radius of every one of those mistakes.
If your account also sends SMS, access control is part of compliance too — our guide to Spam Act rules for GoHighLevel SMS automations explains why one careless bulk send can become a regulator problem.
How to set up GoHighLevel permissions in 7 steps
This is the order I use when I audit or rebuild an account. Do it in one sitting and document what you set.
1. List every person and what they actually do. Write down each staff member, contractor and client user, then note the three or four tasks they perform weekly. Permissions follow tasks, not job titles.
2. Name your Admins — and keep it to one or two. Usually the owner and the operations lead. Everyone else becomes a User, including senior staff. Seniority is not a reason to have access to integrations and billing.
3. Build role templates. Decide what a "Sales", "Front Desk", "Marketing" and "Client" user can see. Use the table below as a starting point, then adjust to your business.
| Role template | Turn ON | Turn OFF | Assigned data only? |
|---|---|---|---|
| Sales / closer | Contacts, Conversations, Opportunities, Calendars | Workflows, Settings, Marketing bulk sends | Yes |
| Front desk / reception | Contacts, Conversations, Calendars, Payments (view) | Workflows, Settings, Opportunities edit | No (they cover everyone) |
| Marketing | Marketing, Sites, Media, Reporting | Settings, Payments, Opportunities | No |
| Client (agency builds) | Contacts, Conversations, Calendars, Reporting | Workflows, Settings, Integrations | Optional |
| Contractor / VA | Only the module they are building or supporting | Everything else | Yes, where possible |
4. Add users from Settings → My Staff. Create each person with their own email address. Never share a login — shared logins destroy your audit trail and make offboarding impossible.
5. Switch on "assigned data only" for sales roles. Pair it with a round robin or assignment rule so new leads land with an owner. Our guide to GoHighLevel round robin calendars shows how to share leads fairly once access is locked down.
6. Turn on two-factor authentication for everyone. Start with Admins and anyone who can export contacts. It takes two minutes per user and closes the most common account-takeover path.
7. Log in as a test user and try to break it. Create a test User with each template, log in, and check what they can see and change. If a sales user can open workflows or a client can reach integrations, fix it before real people log in.
Finally, record the setup in your SOPs. Our guide to documenting delivery SOPs covers where this belongs so the next hire is set up the same way.
Want us to audit your account and lock down access properly? Book a CRM transition call with Pivot 2 Thrive and we will map every user to the access they actually need.
Not on HighLevel yet? Start with a free 30-day trial — enough time to build everything in this guide before you pay a cent.
An Australian example: a five-person physio clinic using GoHighLevel
Picture a Brisbane physiotherapy clinic with two physios, one front-desk coordinator, a part-time marketing contractor and the practice owner.
Before the cleanup, all five were Admins. The contractor could see every patient record and the payment settings, and a workflow had been edited live during a busy Monday.
After a one-hour rebuild: the owner is the only Admin; the front desk is a User with contacts, conversations and calendars; the physios see their own calendars and assigned patients; the contractor only reaches marketing and sites. Two-factor authentication is on for everyone.
Nothing about the clinic's day-to-day work slowed down. What changed is that a mistake by any one person now affects a small corner of the account instead of all of it — which matters even more for a health business handling sensitive information.
Common GoHighLevel permission mistakes to avoid
- Everyone is an Admin. The fastest setup and the most expensive one. Downgrade to User and add modules back as needed.
- Shared logins. One "office@" login for three people means no audit trail and no clean way to remove one of them.
- Forgetting offboarding. Contractors and departed staff keep access for months. Remove users on their last day.
- Clients with workflow access. A well-meaning client edit can break a build you are paid to maintain. Keep workflows and settings off for client users.
- No test login. If you never log in as a restricted user, you don't know what they can actually see.
If a workflow does break, our step-by-step guide to troubleshooting GoHighLevel workflows will help you find the cause quickly.
Frequently Asked Questions
What is the difference between Admin and User in GoHighLevel?
In a GoHighLevel sub-account, an Admin can see and change everything in that account, including settings, integrations and billing-related options. A User only sees the modules and data their permission toggles allow. Most staff should be Users, with one or two named Admins.
Can I stop a GoHighLevel user from seeing every contact?
Yes. Assign the user the User role and turn on the option that limits them to only their assigned data. They will then see the contacts, conversations and opportunities assigned to them rather than the whole database.
Should my agency staff have access to every client sub-account?
No. Agency-level users can be limited to the specific sub-accounts they work on. Give each team member access only to the clients they deliver for, and remove access as soon as they move off an account.
How often should I review GoHighLevel user access?
Review it at least once a quarter and every time someone joins, leaves or changes role. Remove departed staff on their last day, not at the next review.
Does GoHighLevel support two-factor authentication?
Yes. HighLevel supports two-factor authentication for user logins. Turn it on for every user, and treat it as mandatory for anyone with Admin rights or access to client data.
Can I give a client access to their own sub-account without risking my builds?
Yes. Add the client as a User rather than an Admin and switch off the modules they don't need, such as workflows and settings. They can work their leads and calendar without editing the automations you maintain.
Ready for a CRM your whole team can use without putting your data at risk? Book your CRM transition call or explore how we build AI and automation systems at Pivot 2 Thrive.
Setting up a new account for a client? Try HighLevel free for 30 days and build the role structure before anyone logs in.
Related Articles
Our services
Keep reading on the blog
- AI Voice Agent Testing Checklist: What to Test Before Go-Live
- GoHighLevel Custom Fields: Structure Contact Data Properly
- GoHighLevel Tags: A Naming System That Keeps Your CRM Clean
- GoHighLevel Snapshots for AI Agencies
- How to Troubleshoot GoHighLevel Workflows
Everything else
