From http://wiki.vtiger.com/archives

vTigerCRM support the security and limited sharing access of the records, which depends on the role based hierarchy. There are a number of ways by which you can check and make sure about the security.

Profile Level: While creating the profiles admin user can control over the fields and the module to be shown for the newly created profile. Here are number of test cases which can be performed over newly created profiles.

• Create new profiles with different set of permission like view only, create and view, delete and view, all permission (Do not forgot to remove view all and edit all while giving above permission)
• After creating profile with different sets of permission perform all of the functional test cases which are listed in function tests.

Field Level: Profile level control is limited to the particular profile but if you want to control visibility of some fields only to admin user then you have to use the field level controls. Below are the various action which you can take to test this feature.

• Remove all the field for a module using field access (except mandatory fields)
• Create a custom field and disable it
• Now perform all the functional test and see the behavior of the CRM

Module Level: If you want to disable a complete module from the CRM then you have to use module manager for the same. You can also import a new module/Language pack with the help of module manager.

• Using module manager disable a module
• Import a custom module
• Create some new custom field for the newly imported module

Sharing Access Level: From here you can control the visibility of the records across the different user. Like making module private and public. Public has three option. Public (read only), public (read and edit)and public (read and delete). Other than this you can define new custom rules for the private module if you want to share with a particular set of the user. To check this feature you can have these test cases.

• Toggle between the states of the modules. Use all the four available option for different module and check the behavior.
• Create new custom rules like user1 can see only user2's records with create and edit permission, than look for the reaction of the same for other users.