Enterprise Governance: Roles, Permissions, and QA at Scale
Build a durable enterprise governance structure across your sales stack: who owns what, what each role can touch, and how to audit the system before it drifts.
Context
Enterprise governance breaks down at a predictable point: when no one owns the system
Most outbound stacks reach a governance failure state between 15 and 40 reps. Before that threshold, one RevOps admin can hold the configuration in their head. After it, sequences multiply, permissions drift, and data hygiene degrades because the ownership model never scaled past the setup phase.
The fix is a role architecture that assigns clear ownership at the platform layer, a permission design that limits who can break what, and a QA cadence that catches drift before it becomes a revenue problem.
How governance requirements change as the team scales
| Dimension | 1–10 reps (small team) | 11–40 reps (scaling) | 40+ reps (enterprise) |
|---|---|---|---|
| Role model | 1 admin handles everything | Admin + team leads with limited rights | 4-role model: admin, manager, rep, read-only |
| Permissions | Everyone has broad access | Partial restrictions, applied ad hoc | Role-based profiles enforced at platform level |
| Sequence governance | Anyone creates and runs sequences | Manager approval informal or absent | Approval workflow: draft, review, activate, archive |
| Data quality | Manual cleanup as needed | Spot checks by admin | Automated field validation + monthly audit report |
| QA cadence | None formal | Reactive (on complaint) | Proactive: weekly spot check, quarterly full audit |
| Ownership | Single point of knowledge | Implicit delegation | Written RACI mapped to platform roles |
Role Design
The 4-role ownership model for enterprise governance
Enterprise outbound stacks need exactly four roles at the platform level. More roles create permission ambiguity; fewer roles put too much in the hands of individual admins who become single points of failure.
| Role | Who holds it | Platform scope | What they own |
|---|---|---|---|
| Platform Admin | RevOps (1–2 people max) | Full access across all tools | Integrations, user provisioning, global settings, API keys, billing |
| Sales Manager | Team leads and frontline managers | Team-scoped: manage their reps, approve sequences, view team data | Sequence approvals, rep performance data, coaching queue, pipeline visibility for their segment |
| Rep (Executor) | SDR, BDR, AE | Individual scope: their own prospects, sequences, activities, deals | Running approved sequences, logging activity, updating deal stages, owning their pipeline |
| Read-Only Stakeholder | VP Sales, Finance, CS, Marketing | View-only across relevant modules | Pipeline dashboards, forecasting reports, activity logs. No write access to any object. |
Giving managers full admin access is the fastest setup choice and the most expensive long-term mistake. At 40 reps, a dozen people can edit global sequences and change field mappings without a review step: build the custom manager profile before you need it.
Platform-by-Platform
Enterprise governance checklist: permission settings by platform
Each platform in the outbound stack has a different permission model. The four-role architecture above maps onto each platform differently.
| Platform | Admin role | Manager role | Rep role | Read-only role | Common misconfiguration |
|---|---|---|---|---|---|
| System Administrator profile | Custom Profile + Permission Sets scoped to team objects | Standard User profile, object-level sharing rules enforced | Chatter Free license or custom read-only profile | Using default Standard User for managers (too much write access on unrelated objects) | |
| Org Admin | Org Admin with team-scoped profile (Outreach supports custom role profiles) | Standard User, team assignment required for sequence visibility | View-only license for stakeholders | Reps with access to global sequence library (should be team-scoped only) | |
| Admin (Salesloft Admin role) | Team admin scoped to team settings and analytics | Standard (User), cadence access controlled by team assignment | Read-only licenses or dashboard-only sharing | Reps able to edit cadence templates that were set as shared (lock shared cadences) | |
| Super Admin | Admin with user permissions limited to Sales tools and team data | User with object-level permissions defined per property | Free view-only seat (unlimited on Sales Hub) | Granting default Admin to all managers: Super Admin rights should stay with RevOps only | |
| Workspace Admin | Manager role: access to team calls, coaching, scorecards | Rep role: access to own calls and coaching only | Not applicable (no standard free view-only tier) | Managers with access to calls outside their team (creates compliance exposure under consent laws) |
Sequence Approval
Sequence governance: the 4-step approval workflow that prevents drift
Without a sequence approval gate, your library accumulates stale templates, off-brand messaging, and non-compliant copy. At 40+ reps, this is a compliance risk, not just a quality issue.
- Draft
Rep or manager creates the sequence in draft state. Not visible or executable by other reps until approved. Outreach and Salesloft both support draft status natively.
- Review
Manager reviews for tone, compliance (unsubscribe language, consent triggers), and messaging accuracy. In Salesloft, assign a team admin as required approver. In Outreach, use a custom field to flag status and route to a manager view.
- Activate
Manager or RevOps admin moves the sequence to active status and assigns it to the correct team. Reps outside the assigned team should not see it in their sequence list.
- Archive
Any sequence inactive for 90+ days gets archived, not deleted. Archived sequences stay auditable but are removed from active lists. Run an archive pass every quarter as part of the QA cycle.
QA Cadence
The enterprise governance QA process: weekly checks, monthly reports, quarterly audits
QA at enterprise scale runs on three frequencies: weekly checks catch active problems before they compound, monthly reports surface trends, and quarterly audits reset the governance baseline.
| Frequency | Check | Owner | Tool |
|---|---|---|---|
| Weekly | Activity logging completeness: are calls and emails logging to CRM opportunity records? | RevOps | Salesforce report or HubSpot activity feed |
| Weekly | Bounce and opt-out rates by sequence: any sequence above 3% bounce gets paused | RevOps | Outreach analytics or Salesloft Cadence analytics |
| Monthly | Duplicate contact report: merge or suppress records with duplicate email or phone | RevOps | Salesforce duplicate rules or HubSpot deduplicate workflow |
| Monthly | Required field completion rate: stage advancement fields must be above 90% filled | RevOps | CRM field audit report |
| Quarterly | Full user and permission audit: confirm every user is in the correct role profile | RevOps + CISO or IT | Platform admin panel, exported user list |
| Quarterly | Sequence library audit: archive inactive sequences, review active for compliance | Sales Manager + RevOps | Outreach / Salesloft sequence list export |
| Quarterly | Integration health check: confirm all API syncs are logging correctly and no sync errors are queued | RevOps | CRM integration logs, Outreach/Salesloft sync status panels |
Build weekly and monthly checks as saved reports with a fixed owner and a Slack alert for failures. Checks that live only in someone's memory get skipped at the worst time.
Failure Modes
3 patterns that cause governance failure past 25 reps
Most enterprise governance failures trace back to one of three structural problems. Every team past 25 reps without a formal governance structure has hit at least two.
Users accumulate rights as the team scales and nobody removes them when roles change: a manager who left six months ago still has an active login. Run the quarterly user audit on a fixed calendar date, not when someone notices a problem.
Sequence libraries accumulate without archiving: after 18 months, no one knows which are active, which are abandoned, or which contain non-compliant copy. Introduce the four-state lifecycle before the library exceeds 30 sequences.
When calls and emails do not log to CRM opportunity records, pipeline reporting covers roughly 60% of actual activity. Set up automated logging before running your first governance audit: see the Call and Email Logging Hygiene workflow.
FAQ
5 governance questions on admin seats, sequences, and consent laws
How many admin seats should a 50-rep outbound team have?
Two RevOps admins with full platform access is the standard. A third is justified only with distinct regional stacks; beyond three, no one knows who changed a global setting.
Should Sales Managers have admin rights in the sequencing platform?
No: managers need a scoped role covering their team's sequences, rep data, and coaching queue. Full admin rights let managers change global settings that affect every rep; build the custom profile before promoting anyone to team lead.
What is the minimum viable enterprise governance checklist for a 30-rep team?
Four controls: a written RACI for the four platform roles, a sequence approval workflow with one manager-review gate, a weekly logging-completeness check, and a quarterly user-permission audit. These prevent the three failure modes above without requiring a full-time governance function.
How do consent and recording laws affect Gong and CI platform governance?
Two-party consent states (California, Illinois, others) require all parties to know they are being recorded. Restrict manager access to calls only within their team and confirm your legal team has reviewed consent configuration before enabling call recording at scale.
When should lead routing governance be formalized?
As soon as you have more than one routing rule. When lead ownership is ambiguous, deals fall through and attribution disputes slow pipeline reviews: see the Lead Routing Rules workflow.
Governance in place? Now lock down your logging layer.
Roles and permissions mean nothing if call and email activity is not logging correctly to CRM records. The Logging Hygiene workflow covers the exact setup to close that gap.