Roles and permissions
The system roles, what each can see, and the two scoping rules that do most of the work.
The system roles
| Role | For |
|---|---|
| owner | The account holder. Everything, including billing. Cannot be deleted. |
| company_admin | Administers the workspace. Everything except owner-only actions. |
| agent | Works the IT queue. |
| hr_agent | Works the HR queue. |
| hr_admin | Administers HR, including the people records. |
| chat_agent | Live chat only. |
| approver | Approves changes, requests and recoveries. |
| reporting_admin | Reads everything, changes nothing. |
| auditor | Reads everything plus the audit log. |
| requester | Raises and tracks their own requests. Free on every plan. |
Self scope
A requester sees only their own records. This is enforced in the query, not by hiding a link — an attempt to open somebody else's ticket by changing the number in the URL is refused and recorded.
Queue scope
Owner, company_admin, auditor and reporting_admin see both queues. hr_agent and hr_admin see HR only. Other agents see IT only. Staff of the other desk appear as ordinary requesters there, which is usually what people expect and occasionally surprises somebody.
Custom roles
Available on the higher plans. Start from a system role and remove what you do not want, rather than building one from nothing — it is much harder to accidentally grant something that way.