Data access rules let administrators limit which records a group of users can see or change — not just which areas or pages they can open (Premium subscription only). This is how you make sure, for example, that case workers only see their own clients, or that one campus only sees its own donors.
This is an administrator feature. If you just want to find records for yourself, use filters and segments instead — see Finding Records with Filters.
To control which areas and pages staff can open (sidebar modules, view vs edit), use User Groups: What Staff Can Open and Change. Data access rules sit on top of that and narrow which rows those people can reach.
Who can manage this
Your organization must subscribe to the CoolFocus Premium package to access this feature. Only administrators can view, create, edit, or delete data access rules. Non-admin users cannot reach this area, even through direct links or the API.
Rules vs segments — what’s the difference?
They use the same kind of conditions, but they do very different jobs:
A segment is a view you choose in order to narrow a list for yourself. It never hides anything you are allowed to see.
A data access rule is applied automatically by the system to everyone in a user group. It actually limits what those users can see or do — they cannot turn it off.
What a rule is made of
Which records — the entity type it applies to (for example Clients, or Donors)
Which users — the user group the rule governs
What they can do — view, edit, delete, or merge. A rule can allow just viewing while blocking edits, for example
The conditions — the same field and related-record conditions used in filters, combined with match-all or match-any
Priority — when more than one rule could apply, priority decides the order
Create a rule
Go to Settings → Security → User Groups and open the group you want to limit.
Pick the module (for example Care), then find the record type (for example Clients) in the Record Permissions table.
On the View row (or Update, Delete, or Merge), click the small filter icon next to the checkbox.
In the window that opens, name the rule (one is suggested for you) and make sure Active is switched on.
Click Filter to add conditions — the same condition builder you use for filters and segments. For example, limit records to one campus, or to records each person created.
Click Save. The filter icon next to that permission turns blue, which means a rule is in place. Click it any time to review, edit, or remove the rule.
A rule with no conditions does nothing. Empty conditions match every record, so the group keeps full access. Always add at least one condition before you save.
You can also review every rule in one list under Settings → Security → Data Access Rules.
Rules that adapt to the user
Conditions can include placeholders that fill in automatically for whoever is signed in, so one rule covers a whole group:
{{CURRENT_USER_ID}}— the signed-in user (for example, “records this user owns”){{CURRENT_USER_CONTACT_ID}}— the contact record linked to the signed-in user{{TODAY}}— today’s date, with{{TODAY-30}}/{{TODAY+30}}for relative dates
Example: a rule on Cases for the Staff group, with the condition Created By is {{CURRENT_USER_ID}} and view only, so each staff member sees only the cases they created.
Test before you trust it
Use the preview / test option to check which rules apply to a given user for a given record type before you rely on them. It is easy to lock people out of records they need, so preview first, then roll out.
Good to know
Administrators bypass data access rules — they can see everything, by design
Rules are enforced everywhere records are listed, so a restricted user gets a consistent view across the system
Inbox isn’t covered by these rules yet — data access rules don’t currently limit Inbox conversations, and the mailbox list on the left (Your Inbox, Unassigned, Unresolved, All, Confirmed) can’t be hidden for a group
Start narrow and loosen, rather than the reverse — it is safer to grant more access than to discover something leaked
Related
User Groups: What Staff Can Open and Change — controls areas and pages; data access rules control individual records