The three audiences around a note
- Inside the company: staff who need the operational truth to do their jobs.
- Attached outsiders: subcontractors, partners and portal users with narrow access.
- The customer: who sees only what you intentionally publish to them.
Why internal-by-default is the only safe posture
A note that starts internal can always be summarised outward. A note that starts visible cannot be unseen. Since the writer is usually standing in a driveway and not thinking about permissions, the system's default has to be the conservative one.
This also protects candour. People stop writing useful notes the moment they suspect the customer might read the raw text — and a team that stops writing notes is a far bigger problem than an over-restrictive default.
The rule that survives every permission model
Write notes as if they will be read out loud. Not because the system will leak, but because records get produced in disputes, forwarded internally, quoted in emails and read by people who joined the company after you left it.
Factual and unflattering is fine — 'customer refused the recommended repair twice' is a useful note. Editorial and personal is not, and it is never worth the risk it creates.
Where teams get visibility wrong
- Pasting an internal pricing rationale into a customer-facing update.
- Giving a subcontractor access to a whole record to share one instruction.
- Assuming an internal flag hides a note from an export or a report.
- Storing sensitive personal detail in a note because there was no field for it.