Roles and permissions
The system roles, what each can see, and the two ways to narrow or widen that for one person.
The system roles
| Role | For |
|---|---|
| owner | The account holder. Everything, including billing. Cannot be deleted. |
| company_admin | Administers the workspace. Everything except owner-only actions. |
| agent | Works the queue. |
| chat_agent | Live chat only. |
| approver | Approves changes and service requests. |
| reporting_admin | Reads everything, changes nothing. |
| auditor | Reads everything plus the audit log. |
| requester | Raises and tracks their own requests. Free on every plan. |
Self scope
A requester sees only their own records. This is enforced in the query, not by hiding a link — an attempt to open somebody else's ticket by changing the number in the URL is refused.
Extra permissions for one person
A user's page lets you grant individual permissions on top of their role — letting one agent approve changes, say — without inventing a custom role for one person. The extra grants take effect on their next click, and removing them works the same way.
Custom roles
Available from the Growth plan. Start from a system role and remove what you do not want, rather than building one from nothing — it is much harder to accidentally grant something that way.