Multi-user access in a law firm SaaS is not just a convenience feature — it is a professional responsibility question. Not every staff member should have access to every client file. Not every user should be able to export case data or modify firm-level settings. The access control model needs to reflect how a law firm actually organizes its work.
The four role types
Firm Administrator. Full access to firm settings, user management, billing, white-label configuration, and all cases. Typically the managing attorney or office manager. Can create and deactivate user accounts.
Attorney. Full access to all cases assigned to them or their team. Can run exports, download trustee packages, and access all client data for their cases. Cannot modify firm settings or manage other users.
Paralegal / Legal Staff. Access to cases they are assigned to. Can view documents, update checklist status, and communicate with clients through the platform. Cannot run exports or download trustee packages without attorney approval (configurable per firm).
Intake Staff. Access to the intake workflow only — opening new cases, sending portal invitations, and monitoring questionnaire completion. No access to document content or case data beyond completion status.
Audit logging
Every action that modifies case data, downloads documents, or changes access settings is logged with a timestamp and user identifier. The audit log is available to firm administrators and is designed to support any internal review of who accessed what and when.