As your team grows, sharing the same Lark Base with everyone can quickly become a problem. The HR team should not see the sales pipeline. Sales reps should only edit their own deals, not their colleagues’. The finance team needs read-only access to project data — never edit rights.
This is exactly what Lark Base advanced permissions are designed to solve. Instead of an all-or-nothing approach, you can assign different roles to different people — and control exactly what each role can see, edit, or manage.
This guide breaks down how it works in plain language, so SMEs and startups can set up secure, well-organised bases without the headache.
What Are Advanced Permissions in Lark Base?
In a standard Base, anyone you share it with usually gets the same access — typically view or edit. That works for small, trusted teams.
But once your data starts containing sensitive information (salaries, customer details, financials, contracts), you need more control.
Advanced permissions let you:
- Assign roles to different users or groups
- Restrict access to specific records (rows) or fields (columns)
- Choose who can manage permissions themselves
- Set default access for new collaborators automatically
The result: everyone sees and edits exactly what they need — nothing more, nothing less.
Why SMEs and Startups Should Care
For a small team of five, you might get by with one shared Base. But the moment you cross 10–15 people, three problems appear fast:
- Sensitive data leaks. Someone accidentally sees salary information, client contracts, or strategic plans they should not.
- Accidental edits. A teammate changes a critical field they did not realise was important, breaking dashboards, formulas, or reports downstream.
- Cluttered views. Users get overwhelmed by data that has nothing to do with their job.
Advanced permissions solve all three. You build the Base once, then layer in the access rules so it scales cleanly with your team.
How Roles Work in Lark Base
A role is a defined set of permissions you assign to specific users or groups. Each role determines:
- Which tables the user can access
- Which records (rows) they can view or edit
- Which fields (columns) they can view or edit
- Whether they can manage the permissions of others
You can assign multiple users to the same role, or create different roles for different teams. Most SMEs end up with three to five roles that cover their entire organisation.
Tip: Think of roles as job descriptions, not job titles. “Sales Rep – Edit Own Deals” is more useful than just “Sales”. Naming roles by what they do makes ongoing management much easier.
Common Permission Levels Explained
While the exact role names in Lark Base may evolve over time, the underlying access levels follow a familiar pattern.
Here is what each level typically means:
Manage Permissions
The highest level of access. Users with manage permissions can configure advanced permissions, create or edit roles, and assign collaborators. This is usually reserved for the Base owner and one or two trusted admins.
Edit Access
Users can add, edit, or delete records — but only within the scope you allow. You can grant edit access to all records, or limit it to specific records (for example, only records the user created or only records assigned to their team).
View / Read-Only Access
Users can see records and fields but cannot make changes. Perfect for stakeholders who need visibility — such as managers reviewing team progress, or finance staff auditing project data — without the risk of accidental edits.
Field-Level Restrictions
You can hide or restrict editing on specific columns. For example, the “Salary” field might be visible only to HR managers, while everyone else sees the rest of the employee table without that column.
Record-Level Restrictions
You can limit which rows a user can see or edit. For example, sales reps might only see their own deals, while the sales manager sees the entire pipeline.
Tip: Start with the strictest permissions you can. It is much easier to grant additional access later than to claw it back after sensitive data has been seen.
Practical Use Cases for SMEs
Here are common scenarios where advanced permissions make a real difference:
Sales CRM
Sales reps see and edit only their own leads. The sales manager sees the entire team’s pipeline. The marketing team has read-only access to track conversion rates.
HR & Employee Database
HR managers can edit everything, including salary fields. Department heads see only their team’s basic info (name, role, contact). Employees see only their own record.
Project Management
Project managers can create and edit all tasks. Team members can edit only tasks assigned to them. External clients get read-only access to a filtered view of project status.
Finance Tracker
Finance staff edit invoices and expenses. Department heads view their own department’s budget but cannot edit. The CEO has full read access across the entire base.
Customer Support
Support agents edit only the tickets they own. Team leads view all tickets across the team. Other departments get read-only access to filter by their own customers.
How to Plan Your Permission Setup
Before clicking anything in Lark Base, sketch out your permission plan on paper or in a Doc. Here is a simple framework:
- List every type of user who will access the Base (e.g. admin, manager, regular user, viewer, external partner)
- Identify sensitive fields that need protection (salary, client contact info, financial data)
- Identify scoping rules — should users see all records, or only their own?
- Map users to roles — group users with identical needs into the same role
- Set a default role for new collaborators so nobody accidentally gets full access
This 15-minute planning session saves hours of permission-fixing later.
Tip: Use Lark Base’s preview feature to test your permission setup. Administrators can view the Base “as” a different role to see exactly what that user will experience — a safe way to confirm everything is locked down properly before going live.
Pro Tips for Managing Permissions Long-Term
- Audit regularly. Review your roles every quarter. People change positions, leave the company, or take on new responsibilities — permissions should follow.
- Use groups, not individuals. Wherever possible, assign roles to user groups rather than individual people. When someone joins or leaves, you only update the group membership, not every Base.
- Document your roles. Keep a simple Doc that explains what each role can do and why. This is invaluable when onboarding a new admin.
- Test before announcing. Use the preview feature to confirm everything works as expected before rolling out a new permission setup to your team.
- Communicate changes. When you tighten permissions, let affected users know in advance. A surprise loss of access damages trust quickly.
Frequently Asked Questions (FAQ)
1. What are advanced permissions in Lark Base?
Advanced permissions are a granular access control system in Lark Base that lets you define different roles for different users or groups, restricting what they can view, edit, or manage — down to the specific record or field level.
2. How do I set permissions in Lark Base?
Open your Base, go to the permissions or share settings, enable advanced permissions, and create roles that define exactly what each role can access. Then assign users or groups to those roles.
3. Can I restrict who sees certain records in Lark Base?
Yes. You can configure record-level permissions so that users only see specific rows — for example, only the records they created, only records assigned to their team, or records that match a certain filter condition.
4. Can I hide specific fields from certain users?
Yes. Field-level permissions let you hide or make read-only any column for specific roles. This is ideal for sensitive fields like salary, personal contact information, or internal notes.
5. Are advanced permissions available on all Lark plans?
Advanced permission features are available across the Starter, Pro, and Enterprise plans, though the depth of configuration may differ between plans. For the most advanced controls, the Pro and Enterprise plans offer the full set of capabilities.
6. Can I preview what a user will see before applying permissions?
Yes. Lark Base includes a preview feature that lets administrators view the Base as if they were a specific user or role — a safe way to verify your setup before rolling it out.
Build Secure, Scalable Bases with Confidence
Advanced permissions are what transform Lark Base from a simple shared spreadsheet into a proper team data platform.
With the right roles in place, you can give every team member exactly the access they need — keeping sensitive information protected and your data structure clean as your business grows.
For SMEs and startups, mastering this one feature pays off many times over.
It builds trust, protects critical information, and lets you confidently onboard new team members without worrying about who can see what.
Ready to Power Your Business with Lark?
Lark Base is just one part of an all-in-one platform that brings messaging, meetings, documents, approvals, and automations together for your entire team.
As the Platinum Partner for Lark in Malaysia, Exabytes offers tailored Lark plans, hands-on onboarding, and dedicated local support to help you set up secure permission structures, automated workflows, and everything in between.
