> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.contracthero.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Permission concepts compared: Standard, APC and Dynamic


## What's in it for you

The right concept cuts both maintenance effort and security risk. What takes 15 roles under Standard (3 countries × 5 functions, say) can often be expressed as a single role in APC. With Dynamic, ContractHero also takes over person-level contract assignment — useful for account or customer pools where each account manager should only see their own contracts.

## Ground rules (they apply to both models)

* **Inclusion only:** you define what someone may see or edit — there are no “deny” rules. Anything no rule covers is not accessible.
* **Three access levels:** **full (read, write and delete)**, **write (read and edit, without delete)** and **read access**. Each higher level includes the one below it. “No access” is not a selectable level in **APC** — there it simply means no matching rule exists. In **Standard** you can set it explicitly per category.
* **The most generous permission wins:** if someone holds several roles, the rights add up as OR logic — full overrides write, write overrides read, read overrides no access.

## Role basics

* **Owner** — sees and edits everything. We recommend at least two per account so the system is never left without one.
* **Member with a role** — sees only what the role permits. Several roles per person are possible, and their access adds up.

## The two concepts at a glance

| Property | Standard | APC |
| ---- |
| **Driven by** | Category + team | Conditions (category, status, team, counterparty and more), several rules per role |
| **Cross-team in a single role** | No | Yes |
| **Several rules per role** | No | Yes, OR-linked |
| **Access levels** | Full / write / read / no access (selectable per category) | Full / write / read (inclusion only) |
| **Person-level assignment (Dynamic)** | No | Yes, as a capability inside APC |
| **Plan** | All plans | Professional and up |

## 1. Standard — for small, clearly structured organisations

Under the Standard model, access runs through the combination of **team × category**. For each category you pick a level: **full**, **write**, **read access** or **no access**.

**A good fit for:**

* One to three teams with cleanly separated responsibilities (HR sees employment contracts, Finance sees financial contracts).
* Organisations without cross-team responsibility.

**Where it runs out:**

* It scales poorly across multiple dimensions. Three countries × five functions means 15 nearly identical roles. That is the point to move to APC.

## 2. APC — the Advanced Permission Concept for cross-team setups

APC is ContractHero's rule-based permission model, available from the **Professional plan** upwards. Instead of one rigid role per team, you combine **several rules** into a single role that works across teams.

**What it gives you:**

* Roles work **across teams** rather than per team.
* One role can bundle **several rules** (OR logic) — “read everything, edit my own area” in a single role, for example.
* Each rule can combine **several conditions** (AND logic), such as *category = NDA AND status = active AND team = Legal*.
* You choose the access level **per rule**, so one role can grant full access in one area and read-only in another.
* Available condition types: category, status, team, term type, counterparty, payment cycle, payment method, contract type, and type.

**Typical efficiency gain:**

* Finance/Operations across ten countries: **10 roles → 1 APC role** with ten rules.

**A good fit for:**

* Several teams with overlapping responsibilities.
* Setups where combined rules per role noticeably reduce maintenance.

### Dynamic — a capability inside APC

When responsibility doesn't map to categories or teams but to **individual people**, use **Dynamic rules** inside APC. Instead of fixed values, the rule points at **person-level values stored on the member** — and assigns contracts automatically, per person.

**How it works:**

* Person-level values are stored on the member — currently the **partners and accounts (counterparties)** belonging to that person.
* A Dynamic rule references those values: *“counterparty = the member's partners and accounts”*.
* On login, each person sees only the contracts whose counterparty matches their stored values.

**The classic case:**

* **Customer or account pools**: every account manager sees only the contracts of their assigned customers — without you building a separate role per person.

**Important:**

* **Dynamic is not a standalone mode** — it only works when APC is active for the organisation.
* **Structured list fields are required** — free-text and checkbox fields do not work for Dynamic matching.
* Person-level matching is currently limited to **partners and accounts (counterparties)**. Further person-level fields on request.

**What Dynamic is not:**

* “Location”, “creator/uploader” or value ranges are **ordinary static rule conditions** in APC — not automatic per-person matching.

## Which one when?

* **Standard** — small organisations, where responsibility equals team plus category.
* **APC** — several teams, combined rules, Professional plan and up.
* **Dynamic (inside APC)** — individual responsibility via account or partner pools.

For APC, and for Dynamic in particular, we recommend working through the setup with the **Customer Experience team** so your role structure is clean from day one.

## Common questions

**Can I run Standard and APC side by side?**
No. Each organisation runs either Standard or APC, controlled by a central setting. Switching between the models is done together with the CX team.

**Is “Dynamic” a permission concept of its own?**
No. Dynamic is a capability **inside APC** — APC rules that use person-level values stored on the member. No active APC, no Dynamic rules.

**What access levels are there?**
Three: **full (read, write and delete)**, **write (read and edit, without delete)** and **read access**. Each higher level includes the one below. In **APC** you pick the level per rule, and “no access” is not a selectable level — it is the absence of a rule. In **Standard** you pick the level per category and can set “no access” explicitly.

**What happens when someone has several roles?**
Access adds up with **OR logic** — the most generous permission wins. A contract that role A may read and role B may edit is editable for that person.

**Can I deny “everything except X”?**
No — ContractHero works purely with **inclusion logic**. You express “everything except draft” by explicitly including every status other than draft.

**Which person-level fields can Dynamic use?**
Currently **partners and accounts (counterparties)** on the member. Further person-level fields can be reviewed on request — a structured list field is always the prerequisite.

**Moving from Standard to APC — what happens to our existing roles?**
Existing roles are not translated into APC rules automatically. We go through your role structure together and rebuild it in the APC model — typically with far fewer roles than before.

## Good to know

* **Start small, then extend.** Begin with one rule per role in APC, test the behaviour, and only add rules when a real use case demands it. Long rule chains are harder to debug.
* **Telling rule names save time later.** “Read active contracts” or “Write suppliers” can be found again months later — “Rule #2” cannot.
* **Don't reach for full access by reflex.** For teams that should maintain data but not delete it, **write** is the right level. In an audit it makes “who can delete?” a much shorter answer.
* **Owners don't need a role.** An owner already has full access to everything — an extra APC role adds nothing and only causes confusion.
* **Dynamic is powerful, and quiet.** A misconfigured Dynamic rule doesn't throw an error, it produces the wrong visibility. Test with a real member account after every change.
* **Use the setup support.** During onboarding we work through your role structure with you — many customers send a spreadsheet in advance (people × categories/teams × access level) and we build the model from that.

## Related articles

* [What is the Advanced Permission Concept (APC)?](https://support.contracthero.com/en-us/article/what-is-the-advanced-permission-concept-apc-1b1haeg/)
* [How can I create new roles?](https://support.contracthero.com/en-us/article/how-can-i-create-new-roles-14s3bj/)
* [Invite users and manage permissions](https://support.contracthero.com/en-us/article/invite-users-and-manage-permissions-1yk66eu/)
* [What is the purpose of sub-teams, and how are they managed?](https://support.contracthero.com/en-us/article/what-is-the-purpose-of-sub-teams-and-how-are-they-managed-18ewsaq/)