Choose what each team member can see and change
Permissions decide what a person can see and do in your workspace. A role is a named set of that access. Use a custom role when someone needs specific actions, such as taking over conversations, without access to all business settings.
How it works
Section titled “How it works”For invitations, resending or cancelling invitations, disabling access and managing staff groups, see team members and groups. This article explains the access you choose for those people.
Each workspace membership has one role. Your role in one workspace does not give you the same access in another. Before changing someone’s access, check that you are in the right workspace.
There are four built-in roles:
| Role | What it means |
|---|---|
| Owner | Has the workspace’s owner authority. This is fixed, not an editable permission checklist. Owners manage custom-role definitions and owner-only areas. Plan requirements still apply. |
| Admin | Has broad operational and settings permissions, including managing members, conversations, connections and business configuration. Admin is not Owner: it does not grant owner-only powers. |
| Member | The current explicit permission grants include viewing the Handbook, knowledge, Lists and Experts, plus viewing the calendar and managing participants. It is not a general conversation-management or settings-editing role. |
| Viewer | The current explicit permission grants cover viewing the Handbook, knowledge and customer identity. The name does not mean “can view every screen”. |
Some ordinary workspace pages have their own access rules. Do not use a role’s name as a promise that every page is either available or blocked. The System roles table shows the built-in permission grants; use the actual controls on the relevant page too.
Managing your omotto subscription, workspace security policy, custom-role definitions and workspace deletion stays owner-only. Selecting every custom permission does not grant these powers.
Built-in roles cannot be edited. A custom role has its own selected permissions. It does not inherit extra permissions from its fallback role while the custom role is active.
Only an Owner can create, edit or archive custom roles. A person with member-role-management permission can assign available roles to members, but only an Owner can assign Owner or change an existing Owner’s role. The last active Owner cannot be demoted or disabled.
Staff Groups are separate from roles. They organize people for targeting, such as notifications, and do not grant permissions. They are also different from customer groups. Being a notification recipient is not, by itself, authority to carry out an action.
Where to find it
Section titled “Where to find it”Open Settings → People & access → Roles. Use the Members tab to assign a role and the Groups tab for staff groups. The Roles page is owner-only.
Set it up
Section titled “Set it up”Create a custom role
Section titled “Create a custom role”Custom roles must be included in your current plan.
- Open the Roles page described above.
- Choose Create role.
- Enter a Name.
- Choose a Fallback role.
- Add a Description if useful.
- Select the actions the person needs under Permissions.
- Choose Create role to save it.
Creating a role does not assign it to anyone. A new role starts with no selected permissions. Choose the actual access you want before creating it.
Assign the role to a person
Section titled “Assign the role to a person”- Open the Members tab described above.
- Find the person’s row.
- Open the Role selector.
- Choose the built-in or custom role.
- Confirm with Apply changes.
Available custom roles appear alongside built-in roles when the plan includes them. An expired invitation cannot have its role changed; use the invitation recovery procedure in team members and groups.
Change or archive a custom role
Section titled “Change or archive a custom role”- Find the role in Custom roles.
- Choose Edit.
- Change its details or selected permissions.
- Wait for the save status to finish before leaving.
- Choose Back to roles when finished.
Edits save automatically. There is no separate save button for an existing role. Changing the role affects everyone assigned to it, not just one person.
To retire a role:
- Find it in the role list.
- Choose Archive.
- Read the fallback warning.
- Confirm with Archive.
Archiving does not remove the people from the workspace. They use the role’s fallback access instead. The current screen does not offer an unarchive action; assign another available role when needed.
Settings
Section titled “Settings”Role details and selection controls
Section titled “Role details and selection controls”| Setting or control | What it does | Starting value |
|---|---|---|
| Name | The role name shown when assigning it. Required, up to 80 characters, and must differ from other active role names in this workspace, ignoring letter case. | Empty. |
| Description | An optional note explaining who the role is for. It does not change access. | Empty. |
| Fallback role | Access used if the custom role is archived or unavailable on the current plan. Choose Member or Viewer. This is not a permissions starting template. | Member. |
| Permissions | Individual actions grouped by the part of omotto they concern. Only checked permissions belong to this custom role. | None selected in a new role. |
| Select all | Selects every permission in the editor. Clicking it when all are selected clears them. It does not make the person an Owner. | Unchecked in a new role. |
| Checkbox beside a permission-group name | Selects all actions in that group; clicking a fully selected group clears its actions. | Unchecked in a new role. |
View is the named reading permission, but each screen’s access rules still apply. Selecting it does not guarantee that every screen opens, and clearing it does not always block reading. Conversation reading is an important exception, explained below. Update is the editing permission. Manage allows that area’s management actions. Create allows adding an item where offered. Viewing is not permission to change.
For a group that offers View, selecting another action also selects View. Clearing View clears that group’s other actions. Inbox and Conversations remain separate permission groups.
Handbook access is included with some related permissions. Viewing Organization Assistant, Agent contacts, Knowledge or Locations also includes Handbook → View. Updating Organization Assistant or Knowledge, or managing Agent contacts or Locations, includes Handbook → View and Update. Workspace permissions alone do not include Handbook access. Existing custom roles receive the same additions; no existing grants are removed. Built-in Member and Viewer receive Handbook View only, not Update.
The Handbook row shows Included with followed by the source permission-group name. Its included checkboxes stay checked and cannot be cleared while that source action is selected. To remove the included access, first clear its source action, then clear the Handbook permissions you no longer want. Clearing the source does not automatically remove an already selected Handbook permission. Individual settings still require their own editing permission.
Workspace and business settings permissions
Section titled “Workspace and business settings permissions”These are the current group names in the editor, not a guarantee that every related feature is included in your plan.
| Permission group | Actions and purpose |
|---|---|
| Members | View, Invite, Resend, Reactivate, Change role, Disable. Delegate roster access and individual member-management actions separately. Owner protections still apply. |
| Workspace | View, Update for workspace settings. |
| Billing | View, Manage. View opens the plan and billing screens. Manage allows cancelling the subscription and undoing a cancellation. Starting checkout and opening the payment provider’s billing portal stay with the workspace owner. |
| Field schemas | View, Update for the definitions of custom fields. |
| Email templates | View, Update for editable email templates. |
| Notification channels | View, Manage for shared notification-channel connections. This is different from customer chat connections. |
| Notification routing | View, Manage for choosing who receives notifications. |
| Groups | View, Manage for administering staff groups. It does not give group members extra permissions. |
| Organization Assistant | View, Update for bot configuration, including the settings that control bot behaviour. |
| Handbook | View, Update for Handbook access and its editing controls. Individual edits may also require the permission for the setting being changed. |
| Customer identity | View, Resolve, Fold, Reverse, Configure. These distinguish inspecting identity links, resolving conflicts, merging profiles, reversing links or merges, and changing identity settings. |
| Locations | View, Manage for business locations. |
| Integrations | View, Manage for connected business services. |
| Triggers | View, Manage for message triggers described in automations. |
| Automations | View, Update for automation settings. |
| Payments | View, Update, Charge, Capture, Void, Refund. These distinguish viewing customer payments, managing the payment connection, charging, collecting an authorized payment, cancelling an authorization and refunding. This is not permission to manage your omotto subscription. |
Customer service permissions
Section titled “Customer service permissions”| Permission group | Actions and purpose |
|---|---|
| Inbox | View controls access to newer Inbox views and ticket screens. The older conversation-list screen remains readable through active workspace membership without this grant. |
| Inbox views | Manage for managing Inbox views. |
| Conversations | View, Takeover, Assign, React, Audit flag. Ordinary conversation reading uses active workspace membership, not the View checkbox. The other actions cover takeover or sending a directive, assignment, message reactions and flagging a conversation for review. |
| Message templates | View, Manage for WhatsApp templates. |
| Channel connections | View, Manage for customer lines. |
| Notes | View, Create, Manage for conversation notes. |
| Labels | View, Manage, Assign. Separate viewing labels, managing the labels themselves and applying them. |
| Tickets | Manage for ticket management actions. |
| Contacts | Erase for customer-contact erasure. Treat this as destructive access, not ordinary contact viewing. It is separate from Experts below. |
| Audit findings | View, Manage for conversation-review findings. |
Knowledge and business operations permissions
Section titled “Knowledge and business operations permissions”| Permission group | Actions and purpose |
|---|---|
| Knowledge | View, Update for reading and editing knowledge. |
| Lists | View, Manage for structured lists. |
| Meetings | View, Edit availability, Manage, Manage participants. These cover reading the schedule, editing availability, broader meeting management and class-participant operations. Manage includes participant management even if Manage participants is unchecked. |
| Agent contacts | View, Manage for Experts. This editor label refers to the people the bot can consult, not customer contacts. |
| Analytics | View, Update for Analytics access and its editable declaration. |
What happens when…
Section titled “What happens when…”Someone can still read conversations after View is cleared?
Section titled “Someone can still read conversations after View is cleared?”Currently, active membership lets a person read conversations and their messages within that workspace without Conversations → View. The older Inbox conversation list also remains readable without Inbox → View, although newer Inbox views and ticket screens require it. Clearing these checkboxes is therefore not a way to prevent a teammate from reading customer conversations. If someone must lose workspace access, follow the disabling procedure in team members and groups.
Someone can see the meeting schedule but not the class list?
Section titled “Someone can see the meeting schedule but not the class list?”Meetings → View alone does not expose the class list or its archive. The person also needs Manage or Manage participants in that group. Manage participants permits participant operations without permission to create or change the classes themselves. Manage grants broader meeting management and also permits participant operations, even when Manage participants is unchecked.
The plan no longer includes custom roles?
Section titled “The plan no longer includes custom roles?”The role and its assignments remain saved. Its checked custom permissions stop being used, and its Fallback role determines access instead. You cannot create, edit, archive or newly assign custom roles while they are unavailable. When the plan includes custom roles again, existing assignments to non-archived roles use their custom permissions again.
Review the fallback before assigning a role. A role with very narrow custom access can fall back to the broader Member permissions unless you choose Viewer instead.
Someone cannot manage a connection?
Section titled “Someone cannot manage a connection?”Check which connection they are changing. Customer lines use Channel connections, connected business services use Integrations, and shared notification destinations use Notification channels. Give the relevant Manage permission, with View, rather than granting all three unnecessarily. Customer chat connection settings currently require Manage even to open. Integration action configuration also needs Organization Assistant → View.
Someone can read a page but cannot edit it?
Section titled “Someone can read a page but cannot edit it?”Check the action permissions, not just View. Also check the plan and the feature’s own requirements. A permission does not activate a feature that the plan does not include or connect a service that has not been connected.
For the Handbook, View opens the consolidated business reference. Do not assume it exposes only the sections the person can open elsewhere. Editing needs Handbook → Update and the relevant underlying permission, such as Knowledge → Update or Locations → Manage. Giving only the underlying permission does not open the Handbook.
A teammate cannot take over a conversation?
Section titled “A teammate cannot take over a conversation?”Check Conversations → Takeover and its dependent View permission. Check Inbox → View if the Inbox is missing. Imported conversation archives are read-only; adding takeover permission does not turn them into live conversations.
A person receives an approval request but cannot approve it?
Section titled “A person receives an approval request but cannot approve it?”Receiving the notification and being an allowed approver are different things. Check the allowed approvers for that particular action in the relevant feature settings, such as Shopify actions and approvals or booking rules. Do not solve this by granting every permission without checking the approval requirement.
A Coach suggestion is visible but cannot be applied?
Section titled “A Coach suggestion is visible but cannot be applied?”A suggestion is not a permission grant. Applying a Coach settings proposal checks the signed-in person’s authority for the setting being changed. Ask an authorized person to apply it or have the Owner grant the specific access needed.
Someone connects an agent?
Section titled “Someone connects an agent?”A connected agent acts as the connecting person in the chosen workspace. It cannot exceed that person’s current permissions, and its connection also has its own allowed actions. Changing roles is not a way to give the agent owner-only powers without making that person an Owner.
Troubleshooting
Section titled “Troubleshooting”- Roles will not open: ask a workspace Owner to manage role definitions. Being Admin or having member-management permissions is not enough.
- Create role is missing or editing is unavailable: an Owner should check whether the current plan includes custom roles.
- A role cannot be created: enter a nonblank, distinct name within the 80-character limit and check any error shown beside the field or permissions.
- A custom role does less than expected: verify the checked permissions. The fallback is not added to them. Check dependent access, such as Inbox viewing, separately.
- An Owner role change is refused: only an Owner can change Owner assignments, and at least one active Owner must remain.
- A member cannot be invited or reactivated: check member capacity and invitation status in team members and groups. Role permissions do not increase the plan’s member allowance.
- Access is still wrong after a successful save: confirm the current workspace, the person’s assigned role, the relevant action and the plan. If those are correct, contact omotto support with the screen name and the action that failed. Do not send passwords or connection secrets.
Related
Section titled “Related”- Invite members and organize staff groups
- Read and edit the Handbook
- Notification recipients and channels
- Plan, billing and usage
- Connect your own agent