Use Pro staff access controls to separate seeing vault metadata, revealing secrets and managing entries. These controls apply to staff roles, not to individual folders or client-owned rows.

Review every admin role

1. Open PD Password Manager → Settings with Pro active and permission to view, reveal and manage.
2. Find the staff access-control rows and check each admin role.
3. Set See the vault list, Reveal / decrypt secrets and Create, edit and delete entries according to the access you intend.
4. Choose Save access control.
5. Check the resulting permissions with an appropriate staff account and non-sensitive sample data.

The built-in Full Administrator role retains full vault access. An unconfigured or newly introduced role defaults to allowed permissions; review new roles explicitly instead of assuming that they start restricted.

Understand what each permission allows

Reveal access permits decrypting secrets and exporting the vault. Opening an editor can reveal existing values when that permission is allowed. Manage permission allows replacing stored credentials, not just editing labels. Staff permitted all three can change these access settings.

These restrictions are a Pro feature. Without active Pro, the module’s additional vault restrictions do not apply to staff who can reach it. Keep the platform’s own module access appropriate and review the effect before changing entitlement.

Check the boundary

An entry’s Owner, attached client or folder is not a separate staff access boundary. Do not promise that one staff member can access only a particular client’s secrets through these three role controls. If a required separation cannot be represented, do not store credentials on that assumption.

See the PD Password Manager WHMCS guide for related tasks, or explore PD Password Manager.