Advanced Permission Concept (APC): configuring roles with rules

The screenshots in this article show the German interface. The English label is given first, with the German label in square brackets.

What's in it for you

A single APC role often replaces several near-identical standard roles. What the standard concept needs 15 roles for (3 countries × 5 functions), APC frequently handles in one. The available condition types let you filter on contract fields such as status, counterparty or term type — which cuts maintenance and makes the permission model scale.

Typical situations where it pays off:

• Framework agreements that apply across all subsidiaries and countries.
• Centrally signed HR and procurement contracts that several entities need to see.
• IT and licence agreements used group-wide.
• Real estate and service contracts (insurance, fleet, utilities) managed centrally but accessed locally.
• Highly sensitive agreements (financing, M&A, board contracts) with restricted access.

Prerequisites

• APC is part of the Enterprise plan and can also be booked as a separate module on top. It is not part of multi-client capability — the two modules work independently of each other.
• APC has to be switched on for your organisation — moving from Standard to APC runs through the Customer Experience team.
• You need owner status [Eigentümer] in your organisation to create or change roles.

Core principles

• Inclusion only: you define what a role may see or edit — there are no "deny" rules. Anything no rule covers is not visible.
• Two access levels: Read and Edit/Full (Edit includes Read). "No access" is not a selectable level in APC — it is simply the absence of a matching rule.
• The most generous permission wins: several rules in a role are OR-linked. Several roles on a person are OR-linked. Edit overrides Read.

How it works

1. Open the roles area

Go to Settings [Einstellungen].

In the left-hand sidebar, under Organisation, you will find Roles [Rollen] as its own menu item. It opens the "Member roles (X)" [„Mitgliederrollen (X)"] card, subtitled "Set and manage roles to control organisation access".

New since August 2026: Members, Roles and Change log are their own sidebar entries. Previously they lived as cards inside the "Organisation details" page.

2. Create a new role

Click "+ Add new role" [„+ Neue Rolle hinzufügen"]. The "Create new role" [„Neue Rolle erstellen"] dialogue opens. Enter a meaningful role name at the top (e.g. "Legal full access" or "Finance EU – active contracts").

3. Define the first rule

Under "Rules:" [„Regeln:"] you will see a first card with the default name "Rule #1" [„Regel #1"]. You can overwrite the rule name — recommended if you plan several rules per role.

In the "Conditions:" [„Bedingungen:"] section you define when the rule applies. The default reads:

IF category is [select option]

The left-hand dropdown picks the filter criterion. There are currently 9 condition types, all static — they filter on the value held on the contract, not on the member:

The right-hand "Select option" [„Option auswählen"] dropdown picks the concrete values. The "+" icon next to a selected value adds further values (e.g. status is Active OR Terminated).

"+ Add condition" [„+ Bedingung hinzufügen"] combines several different conditions in the same rule (AND-linked). Example: category is NDA AND status is Active AND team is Legal.

4. Set the access level

Under "Access level:" [„Zugriffsstufe:"] choose via radio button:

• Full (read, write & delete) — complete access to contracts matching the condition. Shown as Vollzugriff in the roles overview.
• Read access [Leserechte] — sight of the contracts, but no editing or deleting. Shown as Lesezugriff.

If no rule matches a contract, the role has no access to it — that is the safe default.

5. Add further rules (the actual APC feature)

Below the rules, click "+ New rule" [„+ Neue Regel"] to add a second rule.

Several rules within a role are OR-linked: if at least one rule matches a contract, the person gets the access defined there. Where rules overlap, the more generous permission wins (Full overrides Read access).

Typical combinations:

• Rule #1: status is Active → Read access (see active contracts across all categories)
• Rule #2: category is Supplier contract AND team is Procurement → Full (write your own contracts)

One role with two rules = "read active contracts, write our own supplier contracts". The standard concept would need several separate roles for that.

6. Save the role

Click "Create" [„Erstellen"] at the bottom right. The role appears in the Member roles list and can be assigned to new or existing members from then on.

Dynamic rules within APC

The 9 condition types above are all static — you store fixed values that are compared against the contract. When responsibilities are tied to individual people (the classic case: account managers with their own customer pools), you add Dynamic rules.

How Dynamic rules work:

• Person-specific values are stored on the member — currently the Partners & Accounts (counterparties) of that person.
• The Dynamic rule references those values: "counterparty = the member's Partners & Accounts".
• On login, each person sees only the contracts whose counterparty matches the values stored for them.

Important:

• Dynamic is not a standalone mode — it only works inside APC.
• Dynamic is its own add-on module on top of APC and has to be enabled separately.
• Structured list fields are required (no free text, no checkbox).
• Person-specific matching is currently limited to "Partners & Accounts (counterparties)". Further person-specific fields on request.

What Dynamic is NOT:

Conditions on "location", "creator/uploader" or "value ranges" are ordinary static APC rules — they filter on a fixed value held on the contract, with no automatic per-person matching.

Common questions

Which plan includes APC?

APC is part of the Enterprise plan. Independently of that it can be booked as a separate module — talk to your Customer Success Manager or write to support@contracthero.com.

Do I need multi-client capability in order to use APC?

No. APC and multi-client capability (several companies within one organisation) are two independent modules. You can use APC without mapping several entities — and the other way round.

Does APC also have the "Write" level like standard roles?

No. Since August 2026, standard roles have four levels (No access, Read access, Write, Full). APC still has two: Read access and Full. In APC, "no access" happens when no rule matches.

Which condition types does APC support?

Currently 9 static condition types: category, status, team, term type, counterparty, payment cycle, payment method, contract type and type. Several values per condition are possible (OR within a condition), several conditions per rule are AND-linked, and several rules per role are OR-linked. On top of that there are Dynamic rules for person-specific matching.

How does APC chain several rules in one role?

OR logic, highest permission wins. If at least one rule matches a contract, the person has access. If several rules apply to the same contract, the most generous access level prevails (Full before Read access).

Can one person hold several roles?

Yes. Visibility is added up as a union — a person with the roles "Finance" and "Procurement" sees every contract that at least one of the two roles releases. Here too: the highest permission wins.

What happens if I delete a rule or a condition?

The change takes effect immediately. Members with that role lose or gain the corresponding access on their next page refresh. The contract data itself is unchanged.

Can I forbid "everything except X"?

No. ContractHero works exclusively with inclusion logic — you define what a role sees, not what it must not see. You model "all statuses except Draft" by including status is Active OR Inactive OR Terminated OR Ended in one condition.

What is the difference between a static APC condition and Dynamic?

Static conditions compare contract values against fixed values in the rule (e.g. counterparty is Acme GmbH). Dynamic rules compare contract values against person-specific values on the member — the rule is the same for everyone, but the result is individual per person.

Do you support the setup?

Yes. During onboarding we work through your APC model together — many customers send us a spreadsheet in advance (people × categories/teams × access level), and we build the role structure from it.

Good to know

• Meaningful rule names save time later. "Read active contracts", "Write suppliers", "Draft area" can be found again — "Rule #2" cannot.
• The status condition is powerful. A role that only sees "status is Active" automatically hides old drafts and ended contracts. Handy for external auditors or rotating owners.
• Start small, then extend. Begin with one rule per role, test the behaviour, and add further rules only when the use case demands it. Complex rule chains are harder to debug.
• Use OR logic deliberately. A second rule with "Full" on a broad category overrides existing read restrictions — that can be intended, but it is a common trap in audits.
• Owners do not need a role. An owner automatically has full access to everything — an additional APC role adds nothing and only causes confusion.
• The default is "no access". Anything no rule covers is invisible — a security-conscious default, but it also means you have to actively define what should become visible when creating a role.
• Dynamic is powerful and silent. A misconfigured Dynamic rule reports no error, it just produces the wrong visibility. Test after every change with a real member account.

Related articles

• Permission concepts compared: Standard, APC and Dynamic
• How can I create new roles?
• Multi-client capability: several companies in one organisation
• Invite people: How to manage roles and permissions for additional users
• How do I create a new team and release categories to it?
• What information is available in the Change Log?

Updated on: 10/28/2026