Roles and permissions
Every user in your organization has at least one of four roles, and a user can hold more than one. Access to §203 Professional Secrecy Mode is granted on top of a role. This page shows what each role can do.
The roles
- Super Admin: the highest level of access, including organization settings and §203.
- Admin: manages users, teams and workspace settings, but not organization settings or §203.
- Member: a standard user who works with chat, agents and Knowledge.
- Billing Owner: opens the Billing pages. Without an admin role, a Billing Owner is taken to Billing from any other admin page.
Admins assign roles on the Users page.
What each role can do
Yes means the role can do it, No means it can't.
| Action | Super Admin | Admin | Member | Billing Owner |
|---|---|---|---|---|
| Add files to Personal Knowledge | Yes | Yes | Yes | Yes |
| Add files to Organization Knowledge | Yes | Yes | No | No |
| Rename an Organization file | Yes | Yes | No | No |
| See files shared with you (Shared, read-only) | Yes | Yes | Yes | Yes |
| Change another user's roles | For any other user | Only for users who are not Super Admin, Admin or Billing Owner | No | No |
| Change your own roles | No | No | No | No |
| Delete a user | Any other user, including Super Admins and Admins | Only users who are not Super Admin, Admin or Billing Owner | No | No |
| Reset a user's two-factor authentication (Reset 2FA, user detail page) | For any other user | Only for users who are not Super Admin, Admin or Billing Owner | No | No |
| Open the Organisation page (organization settings) | Yes | No | No | No |
| Open the Audit page | Yes | Yes | No | No |
| Manage teams and connectors for the whole organization (Teams, Connectors) | Yes | Yes | No (only on an agent they own) | No |
| Request or manage §203 access | Yes | No | No | No |
| Turn a user's §203 access on or off (user detail page) | Only the primary §203 administrator (the Super Admin who raised the request), for other users | No | No | No |
| Set up SSO (Security › SSO) | Yes | No | No | No |
| Change PII settings (Security › PII) | Yes | No | No | No |
| Turn the two-factor requirement on or off (Security › MFA) | Yes | No | No | No |
| Pay, see invoices, change the card or the subscription, buy storage (Billing) | Yes | No | No | Yes |
| See the organization's credit balance | Yes | Yes | No | Yes |
Users with the Billing Owner role have the same Knowledge rights as Members. For the rules of each page, see its Permissions & roles section.
§203 Professional Secrecy Mode
- Only Super Admins request §203 for the organization and manage §203 access.
- Admins can't request, enable or revoke §203 for anyone, including themselves.
For how access works, see §203 Professional Secrecy Mode. For the rules on deleting a user with §203 access, see Users.
Where roles are set
Roles are set on the Users page: when a user is invited, and later on the user's detail page. In the invitation, a Super Admin can choose any role, while an Admin can only invite with the Member role.
The person who creates a new workspace can also choose a role for each teammate they invite during onboarding.
You see your own role on your Profile. It is read-only there.
Frequently asked questions
How do I get another role?
Ask a Super Admin or an Admin. An Admin can only change the roles of users who are not a Super Admin, Admin or Billing Owner. Nobody can change their own roles.
Can one person hold more than one role?
Yes. A user can hold several roles and must keep at least one.
What can a Billing Owner do?
Open the Billing pages. A Billing Owner without an admin role is taken to Billing from any other admin page. In Knowledge, a Billing Owner has the same rights as a Member.
Related
Was this page helpful?