For all of the awesome features and power of Salesforce, it doesn’t take an admin very long to run into something bafflingly underpowered. Like, for instance, email templates. Automated emails are easy to trigger based on sophisticated criteria, but giving those emails the personalized touches expected in this day and age? Not so straightforward.

Security and data access in Salesforce are controlled via a powerful and difficult-to-master set of tools. Profiles, permission sets, roles, role hierarchy, sharing settings, and page layouts are all part of the toolbox. They offer different capabilities, but also overlap and interact in ways that can be difficult to wrap your head around.

As part of my work to simplify the permissions and security regime for a forty-seat nonprofit organization, I put together this basic primer on these tools, in hopes of offering ways into this intimidating and mystifying terrain. This guide is written with the small-to-medium sized nonprofit in mind.