Roles and permissions

Six workspace roles. Your role is per workspace — you can be an owner in one and a client in another. Editor and Viewer appear where they're turned on for your workspace.

Who can do what

A scheduled reply can be edited, rescheduled or moved back to the reply box only by the person who scheduled it. Anyone who can reply can cancel it.

Everything not in this table — reading the Inbox, viewing Contacts, Analytics, the Activity log, the AI Playground — is open to every role, Viewer included. A viewer can't move through the setup steps on Home either: those change the workspace's setup. The Work the inbox, Assign conversations, Manage the team inbox and See every conversation rows apply where the team inbox is turned on for your workspace — see Work the Inbox as a team. The See the whole team on Analytics → Team row decides whose work that tab shows: everyone except owners and admins sees their own work there instead of the team's — see See how your team replies. The two Meta rows apply where Meta conversion reporting is turned on — see Report conversions to Meta.

How HyperDM reaches you needs no capability. Where the newer Notifications settings are offered, every role sets their own alert email, browsers, quiet hours, mute and Product updates under Settings → Notifications; only the workspace's alert switches and who gets them need Manage workspace — see Settings.

The agent/client inversion

Look at the last two rows. On the Contacts page an agent sees the tag and field controls but no pause control, while a client sees the pause control but no tag controls.

That is deliberate, and it is the whole reason pause_agent exists as its own capability. A client who has to be able to say "stop replying as me, now" gets exactly that — and not the ability to change your timezone or silence your notification emails, which manage_workspace would have handed them too.

client is also strictly less privileged than agent everywhere else, which is why an admin who may already hand out agent can safely hand out client.

What you see instead of a control you lack

The product hides controls rather than letting you click them and be refused — but it always shows the state, and it usually explains the absence:

• On Contacts, one sentence stands where Add contact would be, so you meet the reason at the first control you'd reach for.
• In a contact's drawer, a member who can't import, export or erase reads who can, where those buttons would be. Unsubscribe is there for every role: honouring an opt-out never waits for a teammate.
• On the channel rows, the connection status stays visible for everyone; only the Connect button and the More actions menu with Disconnect go.
• On the Agent page, the master switch's On / Off state is shown to everyone — someone working the Inbox needs to know whether the AI is also answering — but only owner/admin get the toggle.
• On Media library, the two possible reasons are kept apart: a plan limit ("upgrade") and a role limit ("ask an owner") point at different next steps.
• In the Inbox's Assign menu, a client keeps Assign to me and sees Assign to someone else greyed out, with who can.
• In Settings → Team & roles, agents and clients see the groups, the inbox behaviour, the auto-assignment settings and the labels, with a sentence where the controls would be.
• On the Meta conversion reporting card, an admin reads Waiting for the workspace owner … to confirm who may be reported where the owner's confirmation would be. Agents and clients read the whole card — what each event sends, the deliveries and the totals — with no controls.

Hiding is not the security boundary. Every write is re-checked on the server, so a control you can't see is also a control you can't invoke by any other route. The hiding exists so you aren't clicking things that always bounce.

Inviting

• Owners may invite every role but Owner; Admins may invite the roles below them — Editors, Agents, Clients and Viewers. Nobody can invite an Owner — ownership comes only from creating a workspace.
• Choosing a role is a Pro (and Agency) feature. Below Pro, every invite carries the Agent role — picking Admin or Client is refused with an upgrade message.
• Client appears in the picker only where the client role is enabled for the deployment, and Editor and Viewer only where they're turned on for your workspace; if you don't see one, it isn't switched on for you yet.
• Owners may remove anyone except the last owner; admins may remove agents and clients. A workspace must always keep at least one owner — the last owner cannot leave or be removed.
• In Settings → Team & roles, an agent or a client sees the invite form, Remove and Revoke greyed out with "Only owners and admins can invite, remove or revoke teammates." — shown, not hidden. In Security, anyone but the owner sees Delete workspace… greyed out with "Only the workspace owner can delete it."

Steps: Settings.

Handing the workspace over

Only the owner can offer the workspace, and only an admin can receive it — make someone an admin first. The owner then becomes an admin or leaves, as they chose. The admin accepts with a fresh sign-in of their own (and two-factor, where the workspace requires it). Steps: Settings.

Requiring two-factor

Where two-factor sign-in is turned on for your workspace, only the owner can require it for everyone, from Settings → Security, and only while signed in with their own authenticator code. It applies to every role, the owner included: members get 7 days to set it up, and anyone who joins later sets it up before they get in. Everyone else sees whether it's on, with the button greyed out: "Only the workspace owner can change this."

Steps: Settings.

Approving requests to join

Where join links are turned on, owners and admins create, copy and replace the workspace's join link and approve or decline requests to join — the same people who can invite. Approving follows the invite rules exactly: an admin approves only with a role below admin, nobody is approved as Owner, choosing a role other than Agent is on Pro and up, and the person uses a seat. Everyone else sees neither the link nor the requests. Steps: Settings.

Changing a role

Where Editor and Viewer are turned on, owners and admins change a teammate's role in place — no removing and re-inviting. Walkthrough: Give teammates the right role.

• The owner can move anyone except the owner to any other role.
• An admin can change only the roles below admin, and only to roles below admin.
• Nobody changes their own role — another owner or admin has to.
• A teammate your organization placed in the workspace keeps the role the organization gives them; change it there.
• Below Pro, the only role you can move someone to is Agent.
• The new role applies the next time they load a page.
• Changing someone to Viewer hands their open conversations back to the team (or their group's queue) and takes them out of their inbox groups: a viewer can read the inbox but not answer it. A viewer is never offered when you assign a conversation, and auto-assignment skips them.

Seats

Every role uses a seat — Editor and Viewer included.

A seat is a person, including you — and a pending invite holds one.

Organization roles are different

If your account is in an organization, it also has org-level roles — Owner, Admin, Analyst — which govern access across the organization's workspaces. They are separate from the six workspace roles above.

Common questions

Which role should I give a VA who answers DMs? agent if they should also build automations; client if they should only work the inbox and be able to pause the AI.

Which role for a client who wants to watch their own account? client. They can read everything, reply as a human, and stop the AI — and cannot change your automations, connections or billing.

Why can a client reply and keep saved replies, but not start an automation from the Inbox? Replying is the job a client does. An automation sends as the workspace, and its steps can tag people and set their fields — the same reason a client can't change automations. Their own saved replies are theirs; the team's saved replies are workspace copy, so changing those needs the automations permission too.

Why can an agent edit contacts but not merge them? A merge can't be undone, and it changes the consent and pause state of the contact that stays. So it needs an owner or admin, the same as sending a broadcast.

Why can an agent not turn the AI on? agent is the role invites hand out by default. Without that gate, a support hire could turn the AI on for your whole customer base on their first day.

Why can't I connect Instagram? manage_connections — owner or admin only.

Why can't I set up Hotmart? Same rule: manage_connections — owner or admin only. Switching Hotmart to live lets purchases start flows, so it is gated like connecting a channel. Everyone can read the card and its recent events.

Why can't an admin make the Meta conversion reporting confirmation? It's a legal statement for the business: that it has the permission and lawful basis Meta's Business Tools Terms require to share contacts' conversions with Meta. So only the workspace owner makes it, and only the owner can switch reporting to every contact. Owners and admins do everything else on the card — connect, send a test event, switch events on and off, change the other reporting settings, retry and disconnect. See Report conversions to Meta.

Which role for someone who only needs to look — an accountant, an investor? viewer. They see the inbox, contacts and analytics, and change nothing. They can still record that a contact asked to opt out — honouring an opt-out never waits for a teammate.

Which role for a content person who shouldn't touch billing or connections? editor. They run broadcasts, automations and the AI, and work the inbox — but can't connect channels, see billing, manage the team or export customer data.

Can I make my own custom role? No. The six roles are fixed.

Can an agent see conversations someone else owns? Yes — unless an owner or admin sets Who sees what to Agents and clients see their own in Settings → Team & roles. Then agents and clients see the conversations they own, the unassigned ones and their groups' queues, and nothing else: the server never sends them the others' messages or notes. Owners and admins always see every conversation.

Why can a client take a conversation but not give one to someone else? Routing work between teammates is the agency's job, so assigning to someone else needs an owner, admin or agent. A client can still Assign to me, complete, reopen, label and add notes.