Audit User Roles and Form Access

Audit access systematically

1. List the roles that should create submissions, view their own records, view team records, edit forms and administer the site.
2. Check WordPress user roles and any Gravity Forms or access-control plugin settings.
3. Test each key workflow using a dedicated test account for the relevant role.
4. Check the form page, entries list, entry detail page, uploaded files and dashboard separately.
5. Record any over-permission or unexpected denial.
6. Change the narrowest relevant rule and repeat the test.

Least privilege

Do not grant Administrator access just to let someone view a dashboard or submit a form. Use the least privileged role that supports the job, and review access when a person’s role changes.