🏔️ Summit 2026 Feature
System tab permissions control who can edit specific standard record tabs and subtabs without relying only on broad record update permissions.
🏗️ Provisional document
This feature is pending release, and this document may change over time. Check What’s New for the latest releases.
System tab permissions add a Write Permission setting to eligible system tabs in Database → Tabs. Use this setting when a user should see a system tab but should not edit the data in that tab unless the user has a specific permission.
For example, a user with Person Update can generally edit person data. A write permission on an eligible person system tab can replace that broad edit access for the tab or subtab, so only users with the selected permission can make changes there.
📝 Note
System tab permissions are being expanded across system tabs and subtabs. If a tab does not show the expected permission setting or does not yet follow the restricted edit behavior, test the tab in a test environment before applying the permission model in production.
Before you begin
Identify the system tab or subtab that should have restricted editing.
Choose the standard, exclusive, or custom permission that should grant write access.
Confirm that users who should edit the tab have the selected permission directly or through a role.
Prepare a test account that has normal record access but does not have the selected write permission.
For more information about creating and assigning custom permissions, see Custom Permissions. For more information about record lookup and update permissions, see User Access to Person and Application Records.
Examples
You might use permissions on system tabs to:
Limit editing on sensitive profile subtabs to operations staff while letting counselors continue to view the record information they use for daily outreach.
Give advisors targeted access to update a specific student information area without granting broad edit rights across the full person record.
Protect constituent profile data that only gift processing or data integrity staff should maintain.
Configuring a write permission on a system tab
Go to Database → Tabs.
Select the system tab or subtab to restrict. System tabs appear with System in the Type column.
In the Edit Record in Tabs popup, review the tab name and scope to confirm that you opened the intended tab.
Configure the following settings:
Read Permission: Select a permission only when the tab should be hidden from users who do not have that permission. Leave this setting blank when normal read access should continue.
Write Permission: Select the permission that should grant edit access to the tab.
Select Save.
Testing restricted edit access
Test system tab permissions with at least two accounts: one account that has the selected write permission and one account that has normal record update access but does not have the selected write permission.
Impersonate a user who has the selected write permission.
Open a record that includes the restricted tab.
Confirm that the expected insert links and edit controls appear.
Exit impersonation.
Impersonate a user who can view or update the record but does not have the selected write permission.
Open the same record and tab.
Confirm that insert links and editing controls do not appear.
Open an existing item on the tab and confirm that the popup is read-only.
Understanding override behavior
A write permission on a system tab acts as an override permission. The selected permission replaces the normal system-level edit permission for that tab or subtab.
This behavior supports two common access patterns:
Restrict broad update access: A user can keep Person Update or another standard update permission but lose edit access to a protected system tab unless the user also has the selected write permission.
Grant targeted edit access: A user can edit an eligible tab or subtab through the selected write permission without receiving broader update access than the user needs.
Troubleshooting
The Write Permission setting does not appear
Confirm that the row is an eligible system tab or subtab. Some tabs might not yet support the expanded permission behavior.
A restricted user can still edit the tab
Confirm that the write permission was saved on the correct tab or subtab. Also confirm that the user does not have the selected permission through a role or direct permission assignment.
A user cannot see the tab
Check the Read Permission setting first. If a read permission is selected, the user must have that permission to see the tab.
For more information about other standard tab settings, see Customizing Standard Tabs.