Roles and permissions
Everyone in a workspace has one role. The role decides which parts of the app they can open and what they can do there. On top of the role, each member has a data scope that decides whose records they see.
Roles are managed under Settings → Roles; members get their role and data scope on their team member page. The full module-by-module list is in the permissions matrix.
Built-in roles
Section titled “Built-in roles”| Role | In short |
|---|---|
| Owner | The person who owns the workspace. Everything, including deleting the workspace. One per workspace. |
| Admin | Everything except what only the owner can do. |
| Manager | Full access like the owner. Cannot remove or demote an owner or admin, cannot invite someone as owner or admin, cannot delete the workspace. |
| Agent | Day-to-day work: conversations, CRM, documents, calendar, meetings, WhatsApp and phone. Can view several other areas. No settings, billing, team, automations or marketing. |
| Viewer | Can view every area, change nothing. Never sees billing or the finance book. |
Owner, Admin and Manager always have full access: their permissions cannot be narrowed.
Custom roles
Section titled “Custom roles”In Settings → Roles you can create your own role. Start from a template and adjust:
| Template | Starts with |
|---|---|
| Manager | Full access |
| Agent | The Agent permissions above |
| Sales | CRM and conversations only: a lean menu for sales reps |
| Limited | No operator panels; only student messages (welcome and tasks) |
| Viewer | View only, everywhere |
| Custom | Nothing; you switch on what you need |
Permissions are set per module (CRM, Calendar, WhatsApp, Automations, Billing and so on) and per action in that module (view, create, edit, delete, export, send…). A module without view is hidden from the menu, and its pages are blocked even by direct link.
Per-member overrides
Section titled “Per-member overrides”For one team member you can switch single actions on or off without making a new role. Overrides apply to Agent, Viewer and custom roles. They never apply to Owner, Admin or Manager.
Data scope: only see assigned records
Section titled “Data scope: only see assigned records”Each member’s data scope is All (default) or Only see assigned records. With only assigned, a member sees only the contacts and deals assigned to them or that they created, both in the app and in AI clients connected over MCP. Set it on the member’s page under Settings → Team.
Who manages what
Section titled “Who manages what”| Task | Who |
|---|---|
| Edit any role, including built-in ones | Owner |
| Edit custom roles, Agent and Viewer | Admin, Manager |
| Delete a built-in role | Nobody |
| Create organization API keys | Owner, Admin, Manager |
| Create a personal API key | Any active member |
| Revoke a personal API key | Its owner, or an Owner, Admin or Manager |
| Delete an MCP server | The person who created it, or the workspace’s owner or an admin |
How keys and MCP connections relate to roles: API keys and roles.