Teams and Permissions Overview

How Permissions Work

TrackDrive controls access through three cooperating
layers:

1. Team: defines what a group of users can see and do.
   Each team stores per-model access grants that specify
   which models are enabled, which fields are readable or
   updatable, and which specific record IDs are accessible.

2. Superuser Access: a team can grant superuser status
   to its members. Superusers bypass most permission checks
   but may still be scoped by a list of permitted application
   areas (e.g., analytics, billing, setup). Company owners
   and administrators bypass these area restrictions entirely.

3. Field-Level Access Control: provides column-level
   access control. When a record is accessed by a
   non-superuser, the system checks the user's permissions
   before returning each field value. Unauthorized fields
   are hidden from the response.

How They Interact

A superuser bypasses field-level restrictions and most
permission checks. For non-superusers, the request must
pass the team permission check (does the user's team grant
access to this model and action?), and then field-level
control limits which columns are visible in the response.