Permission concepts compared: Standard, APC and Dynamic

What's in it for you

The right concept cuts both maintenance effort and security risk. What takes 15 roles under Standard (3 countries × 5 functions, say) can often be expressed as a single role in APC. With Dynamic, ContractHero also takes over person-level contract assignment — useful for account or customer pools where each account manager should only see their own contracts.

Ground rules (they apply to both models)

• Inclusion only: you define what someone may see or edit — there are no “deny” rules. Anything no rule covers is not accessible.
• Three access levels: full (read, write and delete), write (read and edit, without delete) and read access. Each higher level includes the one below it. “No access” is not a selectable level in APC — there it simply means no matching rule exists. In Standard you can set it explicitly per category.
• The most generous permission wins: if someone holds several roles, the rights add up as OR logic — full overrides write, write overrides read, read overrides no access.

Role basics

• Owner — sees and edits everything. We recommend at least two per account so the system is never left without one.
• Member with a role — sees only what the role permits. Several roles per person are possible, and their access adds up.

The two concepts at a glance

1. Standard — for small, clearly structured organisations

Under the Standard model, access runs through the combination of team × category. For each category you pick a level: full, write, read access or no access.

A good fit for:

• One to three teams with cleanly separated responsibilities (HR sees employment contracts, Finance sees financial contracts).
• Organisations without cross-team responsibility.

Where it runs out:

• It scales poorly across multiple dimensions. Three countries × five functions means 15 nearly identical roles. That is the point to move to APC.

2. APC — the Advanced Permission Concept for cross-team setups

APC is ContractHero's rule-based permission model, available from the Professional plan upwards. Instead of one rigid role per team, you combine several rules into a single role that works across teams.

What it gives you:

• Roles work across teams rather than per team.
• One role can bundle several rules (OR logic) — “read everything, edit my own area” in a single role, for example.
• Each rule can combine several conditions (AND logic), such as category = NDA AND status = active AND team = Legal.
• You choose the access level per rule, so one role can grant full access in one area and read-only in another.
• Available condition types: category, status, team, term type, counterparty, payment cycle, payment method, contract type, and type.

Typical efficiency gain:

• Finance/Operations across ten countries: 10 roles → 1 APC role with ten rules.

A good fit for:

• Several teams with overlapping responsibilities.
• Setups where combined rules per role noticeably reduce maintenance.

Dynamic — a capability inside APC

When responsibility doesn't map to categories or teams but to individual people, use Dynamic rules inside APC. Instead of fixed values, the rule points at person-level values stored on the member — and assigns contracts automatically, per person.

How it works:

• Person-level values are stored on the member — currently the partners and accounts (counterparties) belonging to that person.
• A Dynamic rule references those values: “counterparty = the member's partners and accounts”.
• On login, each person sees only the contracts whose counterparty matches their stored values.

The classic case:

• Customer or account pools: every account manager sees only the contracts of their assigned customers — without you building a separate role per person.

Important:

• Dynamic is not a standalone mode — it only works when APC is active for the organisation.
• Structured list fields are required — free-text and checkbox fields do not work for Dynamic matching.
• Person-level matching is currently limited to partners and accounts (counterparties). Further person-level fields on request.

What Dynamic is not:

• “Location”, “creator/uploader” or value ranges are ordinary static rule conditions in APC — not automatic per-person matching.

Which one when?

• Standard — small organisations, where responsibility equals team plus category.
• APC — several teams, combined rules, Professional plan and up.
• Dynamic (inside APC) — individual responsibility via account or partner pools.

For APC, and for Dynamic in particular, we recommend working through the setup with the Customer Experience team so your role structure is clean from day one.

Common questions

Can I run Standard and APC side by side?
No. Each organisation runs either Standard or APC, controlled by a central setting. Switching between the models is done together with the CX team.

Is “Dynamic” a permission concept of its own?
No. Dynamic is a capability inside APC — APC rules that use person-level values stored on the member. No active APC, no Dynamic rules.

What access levels are there?
Three: full (read, write and delete), write (read and edit, without delete) and read access. Each higher level includes the one below. In APC you pick the level per rule, and “no access” is not a selectable level — it is the absence of a rule. In Standard you pick the level per category and can set “no access” explicitly.

What happens when someone has several roles?
Access adds up with OR logic — the most generous permission wins. A contract that role A may read and role B may edit is editable for that person.

Can I deny “everything except X”?
No — ContractHero works purely with inclusion logic. You express “everything except draft” by explicitly including every status other than draft.

Which person-level fields can Dynamic use?
Currently partners and accounts (counterparties) on the member. Further person-level fields can be reviewed on request — a structured list field is always the prerequisite.

Moving from Standard to APC — what happens to our existing roles?
Existing roles are not translated into APC rules automatically. We go through your role structure together and rebuild it in the APC model — typically with far fewer roles than before.

Good to know

• Start small, then extend. Begin with one rule per role in APC, test the behaviour, and only add rules when a real use case demands it. Long rule chains are harder to debug.
• Telling rule names save time later. “Read active contracts” or “Write suppliers” can be found again months later — “Rule #2” cannot.
• Don't reach for full access by reflex. For teams that should maintain data but not delete it, write is the right level. In an audit it makes “who can delete?” a much shorter answer.
• Owners don't need a role. An owner already has full access to everything — an extra APC role adds nothing and only causes confusion.
• Dynamic is powerful, and quiet. A misconfigured Dynamic rule doesn't throw an error, it produces the wrong visibility. Test with a real member account after every change.
• Use the setup support. During onboarding we work through your role structure with you — many customers send a spreadsheet in advance (people × categories/teams × access level) and we build the model from that.

Related articles

• What is the Advanced Permission Concept (APC)?
• How can I create new roles?
• Invite users and manage permissions
• What is the purpose of sub-teams, and how are they managed?

Updated on: 09/04/2026