Role-Based Access in AI Screening Tools: What TA Leads Should Test

When we added per-recruiter filtering to the HireQwik interview list in July 2026, filtering the list itself took an afternoon. The harder part was everything around it. A candidate profile has a next-candidate arrow. The list has an Excel export. The shortlist has its own list of screening runs. Each of those reads the same candidates through a separate route, and each one had to apply the same rule, or a recruiter who could not see a colleague’s candidate in the list could still reach it one click later, or download it.

That experience changed how I think about the question buyers ask us in demos: “Do you support multiple recruiters?” Almost every tool does, in the sense that more than one person can log in. The better question is whether access is enforced on every path to the data. This is the checklist we would use if we were evaluating ourselves.

Why the list view is the easy part

Access control that only exists on the main screen is the most common way it fails. OWASP lists broken access control as the top web application security risk, and a large part of that category is exactly this pattern: the obvious page is protected, and a second route to the same records is not.

In recruiting, the second routes are predictable. Exports. Profile navigation. Search. Shared links. Notifications. If a vendor’s demo only ever shows you the list, you have not seen their access control yet.

Set up the demo so it can actually fail

Before running any of the checks, ask the vendor for two accounts in the same demo workspace:

• An admin, who should see everything.
• A recruiter who owns exactly one role, while at least two other roles have candidates in them.

This setup matters because a demo workspace with one role and one user cannot show you a leak even if the product has one. You need other people’s candidates present for their absence to mean anything.

The 10 checks

1. Is every screen filtered, not just the first one?

Log in as the recruiter and open the inbox, the interview list and the shortlist. All three should show only the recruiter’s role. In HireQwik the same rule applies on all three: a recruiter sees roles they own, plus roles nobody owns yet. A tool where the inbox is scoped but the interview list is not has a gap you will hit on day one.

2. Does the export follow the filter?

Export the interview list as the recruiter and open the file. Count the roles in it. An export is the moment candidate data leaves the tool, so it is the one place a leak does real damage. Ours applies the same scope as the screen, including when an admin has narrowed their own view.

3. Does next-candidate navigation stay inside the role?

Open a candidate profile and click through to the next and previous candidate a few times. If the arrows ever land on someone from another role, the list is filtered but the navigation is not.

4. Can the admin see everything, and narrow it on demand?

Switch to the admin. They should see every role without doing anything. Then look for a way to narrow to their own roles, since many TA leads also hire. HireQwik has a My roles toggle for this, and it is saved in the page address, so “everyone” and “mine” can be two bookmarks.

5. What happens to a role with no owner?

Create a role and do not assign it. Can the recruiter see it? There is no universally right answer, but the vendor should know theirs. Ours keeps unassigned roles visible to every member so nothing disappears when ownership is introduced to an existing workspace. The trade-off is that unassigned roles need an owner quickly.

6. Is ownership set per role, and can it be moved?

Ask how to reassign a role when a recruiter leaves or goes on leave. It should be a single change that moves the role’s inbox, interviews and shortlist together, with no re-screening and no lost history. Ask whether there is one screen showing every role and its owner, or whether you have to open each role one by one.

7. Can a user raise their own access?

Ask the recruiter account to promote itself. It should not be possible. In HireQwik the level control does not appear on your own row, and the server rejects the request even if someone sends it directly.

8. Can the workspace lose its last admin?

Ask what happens if an admin tries to demote or remove the only other admin. The tool should refuse. A workspace with zero admins cannot invite anyone, fix settings or reassign roles, and the recovery usually means a support ticket in the middle of a hiring week.

9. Are automated decisions scoped per role?

Ask where auto-reject and auto-advance are configured. If they are workspace-wide, one recruiter’s appetite for automation becomes everyone’s. In HireQwik they are per-role opt-ins, and never on by default, so a volume campus role can use auto-decide bands while a senior role stays fully manual.

10. What leaves the tool in notifications?

Ask what a Slack or Microsoft Teams alert contains. Notifications are a quiet route out of any access model, because a channel often has more people in it than the workspace does. Ours carry the candidate’s name and role and a link back into the app, and nothing else; the link then applies the normal access rules. Only admins can configure where alerts go.

A 20-minute demo script

Vendors plan their demos around the features they are proudest of, so role-based access tends to get two minutes at the end if it comes up at all. Asking for a dedicated slot and running it yourself changes that. Here is a script that fits the ten checks into twenty minutes.

Minutes 0 to 3: set the scene. Confirm the two accounts exist, that the recruiter owns one role, and that at least two other roles have candidates. Ask the vendor to share their screen logged in as the recruiter.

Minutes 3 to 9: the data checks. Walk the inbox, the interview list and the shortlist (check 1). Export the list and open the file on screen (check 2). Open a profile and press next five or six times (check 3). This block tells you whether there is a leak, so do not let it get cut short.

Minutes 9 to 13: the admin view. Switch accounts. Confirm the admin sees every role, then narrow to their own (check 4). Create a role without an owner and switch back to see whether the recruiter picks it up (check 5). Reassign one role to the recruiter and confirm it appears (check 6).

Minutes 13 to 17: the guardrails. Ask the recruiter to change their own level (check 7). Ask what happens if the admin tries to demote the last other admin (check 8). Ask to see where automation is switched on (check 9).

Minutes 17 to 20: what leaves the tool. Ask to see a sample Slack or Teams alert (check 10), then ask how scorecards are shared outside the workspace. Close by asking what the vendor would have done differently if they rebuilt their access model today. The answer is often more revealing than any single check.

Red flags in the vendor’s answers

The checks tell you what the product does. The answers around them tell you how the vendor thinks about it. A few responses are worth writing down when you hear them:

• “We can set that up for you.” If filtering or reassignment needs the vendor’s support team, every recruiter change during your peak season becomes a ticket.
• “Most customers just use one login.” This usually means the product was designed for a single recruiter and multi-user support came later.
• “The export is for admins, so it isn’t filtered.” Then any recruiter promoted for convenience can download every candidate in the company.
• “We are adding that next quarter.” Fine for a nice-to-have. Not fine for checks 1 to 3.
• “It depends how you configure it.” Sometimes true, but ask what the default is. Defaults are what a busy team actually runs with.

None of these is automatically disqualifying. Each is a prompt for a follow-up question before you sign anything.

Sharing outside the workspace is its own access question

Everything above concerns people with a login. But hiring managers, panel interviewers and business heads often need to see a candidate without joining the workspace, and that path deserves the same scrutiny.

In HireQwik, a recruiter can share a single candidate’s scorecard as a read-only page: the verdict, the scores and the transcript, with a recording link that deliberately expires quickly. The share can be revoked. That design means a hiring manager never needs a seat just to read a shortlist, which keeps the number of people with workspace access small. We explain the details in sharing a scorecard with a hiring manager.

When evaluating any tool, ask three things about its sharing: does a shared link show one candidate or a whole list, can you revoke it, and how long does any recording link stay usable. A tool with perfect internal access control and a permanent, unrevokable public link has simply moved the leak.

Questions that should come after the checks

A tool can pass all ten and still not fit your team. Three follow-ups tell you how the vendor thinks:

• Does a level change take effect immediately? Ask whether demoting someone applies at their next request or only when their session expires. Ours applies on the server immediately.
• Is there a record of who did what? Separate logins are what make an audit trail meaningful. Ask whether the vendor discourages shared logins or quietly tolerates them.
• Which integrations are admin-only? Connections such as an ATS key should be restricted to admins and never shown back in full after they are saved.

A scoring sheet you can copy

Give each check a simple result during the demo:

Any fail on the first three is a data problem, not a preference. Everything else is about how much manual work the tool will create for your admins.

Where this sits in a buying decision

Role-based access is rarely the reason a team picks an AI screening tool. Screening quality, candidate experience and cost per hire rightly come first. But it is often the reason a team is unhappy three months in, when five recruiters are sharing a workspace that was only ever tested with one.

It also compounds. A tool with weak access control does not just cause one bad afternoon; it pushes teams into workarounds such as shared logins, separate workspaces per recruiter and manual exports trimmed in a spreadsheet before they go to a hiring manager. Each workaround is small, and together they undo the time the AI screening was supposed to save.

If you want to run these ten checks on HireQwik, book a demo and ask for the two-account setup. We would rather you find a gap in the demo than in the middle of a drive. For how the ownership model works once you are live, see splitting AI screening by role.