A Guide to User Role Permissions
This document outlines the key differences between the four user roles in the system: Owner, Admin, Trusted Employee, and Part-time Agent.
The framework uses Role-Based Access Control (RBAC) to create a clear hierarchy, ensuring users only have access to the features necessary for their jobs.
1. Owner vs. Admin
An Owner is the user that first created the account. This is the highest-level distinction, separating ultimate account authority from operational management.
An Admin CANNOT do the following (while an Owner can):
- Manage Billing & Subscription: Cannot access or change payment details, view invoices, or alter the subscription plan
- Update Core Company Profile: Cannot change foundational company information like the official business name or address
- Manage Critical Integrations: Cannot add, edit, or remove core connections like messaging channels or webhooks
- The Owner is the owner of the restaurant franchise. They sign the lease, control the bank account, and decide which suppliers to use.
- The Admin is the General Manager. They run the entire restaurant—hiring staff, managing inventory—but can't change the restaurant's ownership.
2. Admin vs. Trusted Employee
This comparison separates system configuration from system operation. An Admin builds and configures the workspace's tools, while a Trusted Employee operates within that system.
A Trusted Employee CANNOT do the following (while an Admin can):
- Manage Users: No ability to add, edit, or delete other users
- Build or Change Workflows: Cannot create, edit, delete, or clone automations
- Create or Manage Content Libraries: Cannot create, edit, or delete message templates or Knowledge Base articles
- Alter Data Structure: Cannot create, edit, or delete custom data fields
- Perform Bulk Data Operations: No access to CSV importing, bulk deletion, or full data exports
- The Admin is the architect who designs and builds a house
- The Trusted Employee is the homeowner who can furnish and manage daily life, but cannot change the fundamental structure
3. Trusted Employee vs. Part-time Agent
This separates data stewardship from simple task execution.
A Part-time Agent CANNOT do the following (while a Trusted Employee can):
- Manage the Lead Lifecycle: Cannot create new leads, delete existing leads, or merge duplicates
- Organize Lead Data: Cannot add, change, or remove tags from leads
- Perform Key Conversation Actions: Cannot delete conversation histories
- Export Data: Blocked from exporting lead data to files like Excel
- The Trusted Employee is the head librarian who can acquire, remove, and organize books
- The Part-time Agent is the library assistant who can check books in and out but cannot decide which books to acquire or remove