How do I let a colleague see only their own customers?

A role is a name and a list of permissions (reading customers, issuing invoices, say), not one of four fixed words. So there can be a "Bookkeeper" role that issues invoices but never sees the sales pipeline. Until a company touches the roles, the built-in templates apply.

• Sharing a record always widens access and never narrows it: the owner still sees it, and the colleague or team is added beside them.
• If a team and a person are both given a share, the stronger of the two applies.
• Classification can be switched on too: a record has a classification and a colleague a clearance, and a lower clearance does not open a higher-classified record, not even through a share or as its owner. Only administrators are exempt.
• Sharing and classification are off by default, so nobody's view changes when they are introduced.

Beyond lists and detail pages, it applies on edit pages, in search, in report totals, in CSV exports, in pickers (a customer picker on a task, say), in scheduled report emails and in the AI assistant. A record you may not see answers 404 just like one that does not exist. An API key is not tied to a person, so a key is narrowed by its scopes rather than by record scope.