# Permissions

> Every permission a role can hold, what it allows, and which built-in roles have it.

Source: https://docs.soosh.io/reference/permissions/

These are all the permissions a role can hold, grouped as the role editor
groups them. Open a role in [**Settings > Roles and permissions**](https://app.soosh.io/settings/roles) to see its
permissions. For how roles work, see
[Roles and permissions](https://docs.soosh.io/concepts/roles-and-permissions/).

## How the role editor is laid out

The **Permissions** card on a role's page has two tabs, **Simple** and
**Detailed**. This page lists what **Detailed** shows.

In **Detailed**, a menu lists the sections and you see one at a time.
**Workspace** comes first; the other sections follow in alphabetical order.
Each section shows how many of its permissions are on. Each area in a section
is a row with a level, **No access**, **View** or **Manage**. Open the row to
see its permissions, one checkbox each, with what it allows.

The checkboxes are named for their action:

| Action | Meaning |
|---|---|
| **View** | See the area. Without it, the area and its menu item are hidden. Giving **Create and edit** or **Delete** on an area gives **View** on it too. |
| **Create and edit** | Add new items and change existing ones. |
| **Assign**, **Take from the queue**, **Manage**, **Run**, **Sync from Meta**, **Import**, **Export** | A specific action, listed under the areas that have it. |
| **Delete** | Remove items. |

Checkboxes are greyed out when you don't hold that permission yourself, or
when the role is a built-in one.

### Extra permissions in Simple

**Simple** shows a level for each area, and a few permissions that need their
own switch under **Extra permissions**:

| In Simple | Permission in Detailed |
|---|---|
| **Assign chats to other people** | **Create and edit** under Chat assignment |
| **Take chats from every team's queue** | **Manage** under Queue |
| **See every call and recording** | **View** under Call records |
| **Run chat actions** | **Run** under Chat actions |
| **Download the contact list** | **Export** under Contacts |
| **Use API keys and webhooks** | The API keys and Webhooks permissions |
| **Create and change roles** | The Roles permissions |

## Built-in roles

The marks in the tables below show the defaults of each built-in role.

| Role | Permissions |
|---|---|
| **Owner** | Every permission. |
| **Admin** | Every permission except **Create and edit** under Billing. |
| **Manager** | Only the marked permissions. |
| **Agent** | Only the marked permissions. |

Built-in roles can't be changed. To give someone a different set, make a
custom role.

## Workspace

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Members** | View | See the list of members and open their profiles. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Add members and change their role. Each member changes their own name, email and password. | ✓ | ✓ |  |  |
|  | Delete | Remove members from the workspace. | ✓ | ✓ |  |  |
| **Teams** | View | See teams and who is in them. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create teams and change their members. | ✓ | ✓ |  |  |
|  | Delete | Delete teams. | ✓ | ✓ |  |  |
| **Workspace membership** | View | See the workspace membership list. | ✓ | ✓ | ✓ |  |
|  | Assign | Add someone with a Soosh account by email or ID, remove a member, or change a member’s role. No screen uses it: the **Members** page uses **Members** permissions, and API keys can’t manage members. | ✓ | ✓ |  |  |
| **General settings** | View | See the workspace’s general settings. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Change the time zone and defaults. Only the owner can change the workspace name. | ✓ | ✓ | ✓ |  |
| **Roles** | View | See roles and what each allows. | ✓ | ✓ |  |  |
|  | Create and edit | Create and edit custom roles. | ✓ | ✓ |  |  |
|  | Delete | Delete custom roles that no member holds. Only the owner deletes one that only the owner can give. | ✓ | ✓ |  |  |

## Chats

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Saved replies** | View | See and use saved replies in chats. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Create and edit saved replies. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete saved replies. | ✓ | ✓ | ✓ |  |
| **Queue** | View | Open the queue of chats waiting for a person. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Hand a chat you can see to the queue, a team or yourself, and close the transfer of a chat handed to you, by you or assigned to you. Handing it to a named person needs **Assign**. | ✓ | ✓ | ✓ | ✓ |
|  | Take from the queue | Take the next chat from the queue with **Pick next**, from your own teams’ queues. Without **Manage**, this also needs **Allow agents to pick from queue** turned on in bot settings. | ✓ | ✓ | ✓ | ✓ |
|  | Manage | See the whole queue, not only your teams’ chats, assign queued chats and hand chats to others, and pick from any queue whatever the bot settings say. With Create and edit, also close any transfer. | ✓ | ✓ | ✓ |  |
| **Agent routing** | View | See how handed-over chats reach agents. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Change agent routing settings. | ✓ | ✓ | ✓ |  |
| **Business hours** | View | See opening hours and the out-of-hours reply. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Change opening hours and the out-of-hours reply. | ✓ | ✓ | ✓ |  |
| **Response times and inactive chats** | View | See response-time targets and inactive-chat reminders. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Change response-time targets, escalation and inactive-chat reminders. | ✓ | ✓ | ✓ |  |
| **Chats** | View | Open the inbox and read chats. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Send messages to customers. | ✓ | ✓ | ✓ | ✓ |
| **Chat assignment** | Create and edit | Assign a chat to a member with **Assign to agent**, or clear its assignee. Also lets them hand a chat to a named person. | ✓ | ✓ | ✓ |  |

## Contacts

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Contacts** | View | See the contacts list and every chat. Without it, members see only chats assigned or handed to them. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Add and edit contacts, and change their tags. | ✓ | ✓ | ✓ |  |
|  | Import | Import contacts from a file. | ✓ | ✓ | ✓ |  |
|  | Export | Export contacts to a file. | ✓ | ✓ |  |  |
|  | Delete | Delete contacts. | ✓ | ✓ | ✓ |  |
| **Tags** | View | See tags, including on contacts. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Create and edit tags. | ✓ | ✓ | ✓ |  |
|  | Import | Import tags from a CSV file on the Tags page. | ✓ | ✓ |  |  |
|  | Export | Export tags to a CSV file from the Tags page. | ✓ | ✓ |  |  |
|  | Delete | Delete tags. | ✓ | ✓ | ✓ |  |

Exporting also needs **View** on the same area: **Export** under Contacts
works only with **View** under Contacts, and the same for Tags. Only the owner
gives **Export** under Contacts to a role other than Admin (see
[Permissions only the owner gives](#permissions-only-the-owner-gives)).

## WhatsApp

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Message templates** | View | See templates and their status. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit templates, and submit them to Meta. | ✓ | ✓ | ✓ |  |
|  | Sync from Meta | Update templates from Meta with **Sync from Meta**. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete templates. | ✓ | ✓ | ✓ |  |
| **WhatsApp numbers** | View | See connected numbers. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Connect numbers and change their settings. | ✓ | ✓ | ✓ |  |
|  | Delete | Disconnect and delete numbers. | ✓ | ✓ | ✓ |  |
| **Catalogs** | View | See product catalogs and their products. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Create catalogs, get them from WhatsApp, and add and edit their products. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete catalogs and their products. | ✓ | ✓ | ✓ |  |

## Calls

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Call records** | View | See every call and its recording. Without it, members see only their own calls. | ✓ | ✓ | ✓ |  |
| **Call menus** | View | See call menus. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit call menus. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete call menus. | ✓ | ✓ | ✓ |  |
| **Call transfers** | View | See incoming calls and transfers. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Answer incoming calls, accept and transfer calls, and follow up missed calls. | ✓ | ✓ | ✓ | ✓ |
| **Outgoing calls** | View | See the status of outgoing calls. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Call customers and ask for their permission to call. | ✓ | ✓ | ✓ | ✓ |
| **Call settings** | View | See the call settings. | ✓ | ✓ |  |  |
|  | Create and edit | Change call settings, audio and call experience. | ✓ | ✓ |  |  |

## Campaigns

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Campaigns** | View | See campaigns and their results. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit campaigns. | ✓ | ✓ | ✓ |  |
|  | Run | Start, schedule, pause, cancel and retry campaigns. Setting a follow-up also needs Create and edit here and View on Contacts. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete campaigns. | ✓ | ✓ | ✓ |  |

## Bot

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Bot settings** | View | See the bot’s settings. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Change the bot’s replies, chat timeout and AI settings. | ✓ | ✓ | ✓ |  |
| **Bot flows** | View | See bot flows. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit bot flows. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete bot flows. | ✓ | ✓ | ✓ |  |
| **Keyword replies** | View | See keyword replies. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit keyword replies. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete keyword replies. | ✓ | ✓ | ✓ |  |
| **Knowledge base** | View | See knowledge sources. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit knowledge sources. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete knowledge sources. | ✓ | ✓ | ✓ |  |
| **Customer memory** | View | See what Soosh remembers about a customer, beside their chat. | ✓ | ✓ | ✓ | ✓ |
|  | Create and edit | Add to, edit and remove what Soosh remembers. | ✓ | ✓ | ✓ | ✓ |

## WhatsApp forms

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **WhatsApp forms** | View | See WhatsApp forms. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create, edit and send WhatsApp forms. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete WhatsApp forms. | ✓ | ✓ | ✓ |  |

## Analytics

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Analytics** | View | See the dashboard and WhatsApp insights. With **View** on Team performance, see every agent’s figures there. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit dashboard widgets. | ✓ | ✓ |  |  |
|  | Delete | Delete dashboard widgets. | ✓ | ✓ |  |  |
| **Team performance** | View | Open the Team performance page. Without **View** on Analytics, it shows only your own figures. | ✓ | ✓ | ✓ | ✓ |

## Integrations

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Webhooks** | View | See webhooks. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit webhooks. | ✓ | ✓ | ✓ |  |
|  | Delete | Delete webhooks. | ✓ | ✓ | ✓ |  |
| **API keys** | View | See the workspace’s API keys, and when and from where each was last used. | ✓ | ✓ |  |  |
|  | Create and edit | Create, change, rotate and revoke API keys. A key can only be given permissions the person setting it up has. | ✓ | ✓ |  |  |
|  | Delete | Delete keys that are revoked or expired. | ✓ | ✓ |  |  |
| **Chat actions** | View | See chat actions. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Create and edit chat actions. | ✓ | ✓ | ✓ |  |
|  | Run | Run chat actions from a chat. | ✓ | ✓ | ✓ | ✓ |
|  | Delete | Delete chat actions. | ✓ | ✓ | ✓ |  |
| **Store integrations** | View | See connected stores. | ✓ | ✓ | ✓ |  |
|  | Create and edit | Connect, sync and disconnect stores. | ✓ | ✓ |  |  |

## Billing and audit

| Area | Action | What it allows | Owner | Admin | Manager | Agent |
|---|---|---|:-:|:-:|:-:|:-:|
| **Audit logs** | View | Read the audit log. | ✓ | ✓ |  |  |
| **Billing** | View | See the wallet balance and transactions. | ✓ | ✓ |  |  |
|  | Create and edit | Add money to the wallet and manage automatic top-up. | ✓ |  |  |  |

## Permissions only the owner gives

**Create and edit** under Billing is the only permission the built-in Admin
role doesn't have. By default only the owner can add money to the wallet and
manage automatic top-up.

The built-in Admin role has these, but no other role gets them unless the
owner gives them:

- **Create and edit** under Members: invite members and change their role.
- **Delete** under Members: remove members from the workspace.
- **Assign** under Workspace membership: add and remove members and change
  their role through the API.
- **Export** under Contacts: download the contact list. It also needs **View**
  under Contacts.

The owner can give any of these, or **Create and edit** under Billing, to a
custom role. A role with any of them is then reserved for the owner to create,
edit and give out, and only the owner can manage the members who hold it.
Teams permissions aren't reserved.

## Rules for granting permissions

- **You can only grant what you hold.** In the role editor, permissions you
  don't hold are greyed out. The editor says "You can only give permissions
  you have yourself."
- **Create and edit and Delete include View.** Saving a role with **Create
  and edit** or **Delete** on an area gives it **View** on that area too. If
  you don't have that **View** yourself, the role can't be saved with them.
  Other actions, like **Run** or **Export**, are given on their own.
- **You can't change your own role.** The permissions of the role you hold are
  read-only to you.
- **Areas your workspace doesn't have aren't listed.** Permissions already
  saved for them are kept and give no access. The editor offers **Remove them**.
- **Some powers are never offered.** Single sign-on settings and creating or
  deleting workspaces are managed by Soosh.

## Related

- [Roles and permissions](https://docs.soosh.io/concepts/roles-and-permissions/)
- [How chats are assigned](https://docs.soosh.io/concepts/how-chats-are-assigned/)
- [How billing works](https://docs.soosh.io/concepts/how-billing-works/)
- [Create a role](https://docs.soosh.io/guides/workspace/create-a-role/)
- [Change a member's role](https://docs.soosh.io/guides/workspace/change-a-users-role/)
- [Invite a member](https://docs.soosh.io/guides/workspace/add-a-user/)
- [Limits](https://docs.soosh.io/reference/limits/)