Roles and permissions

A role is a bundle of permissions with a name. You build the bundle once, then give it to people — a member’s role decides which screens they see and what they can do on them. This page covers building a role, giving it out, and the one place where the simple view is not enough.

Before you start

Seeing this section needs view access to Roles and Permissions.
Creating and editing roles both need edit access to it — one permission covers both.
Deleting needs delete access.
The Members column also needs view access to Members. Without it every row shows a dash there.

Steps

Open Roles

In the sidebar, click Settings, then the Roles tab. On a computer, the Search roles box sits at the right-hand end of the Settings tab row. There is no role search on a phone.

One row per role; the Access column summarises what it grants

The Access column names what the role grants, up to four chips. A green chip means that permission is granted in full, amber means partly. Anything past four collapses into a +N chip — hover it and it spells out each one, and whether it is full or partial.

The Members column shows the faces of everyone holding the role, or a dash when nobody does.

Create a role

In the top bar (on a phone, at the top right of Settings), click Add and pick Role. If the workspace has no roles yet, the empty state offers Create role instead — same editor.

In Role Management:

If you already have a role that is close to what you want, use Start from… at the top right and pick it. Every permission is copied in, ready to adjust.
Type a Role Name. It is required.
Set the access, permission by permission (below).
Click Save changes.

Each permission is one dropdown with four levels

Permissions are grouped under Data & CRM, Messaging and Admin & Workspace. Each group has Set all: with a dropdown, for when a role should have the same level across a whole group.

Saving confirms with Role "<name>" created.

Give the role to people

As soon as a new role is saved, Assign members opens on top of it:

Give the new “<role>” role to teammates now, or skip and do it later.

Tick the people who should have it and click Assign to the role name, or click Skip and do it later from Members.

Assign members opens straight after a role is created

Use Advanced when four levels are not enough

The four levels cover almost everything. When you need a shape they do not — say delete without edit — switch Advanced on at the top of the editor. It shows Create, Read, Update and Delete as separate tick boxes per permission, with ALL to tick a whole row.

Advanced replaces each dropdown with the four verbs

Two things you cannot untick:

READ stays on for Workspace, Databases, Lead Table and Field Configuration. It is forced on our side, so unticking it would not stick.
READ comes on automatically the moment you grant Create, Update or Delete on anything. Being allowed to change something you cannot see is not a workable combination.

Switch Advanced back off and any row that still matches one of the four levels shows that level again. A row that matches none of them reads Custom until you pick a real level.

Edit or delete a role

On the role’s row, the pencil (Edit role) reopens the editor as Edit Role; the bin (Delete role) removes it. Missing buttons mean your role does not include that action — they are hidden rather than greyed out.

The bin only appears when the role has nobody in it and it is not the workspace’s default role. Move people onto another role first, then delete.

What each access level grants

Level	What the person can actually do
No access	Nothing — the feature is not there for them
View only	See it, change nothing
Can edit	See it, add to it and change it — but not delete
Full access	See, add, change and delete

Can edit is the one people get wrong. If a member needs to remove things, they need Full access, not Can edit.

The permission names you will see

Some permissions are named for the part of the product they cover rather than for the screen:

In the editor	What it covers
Lead Assignment	Handing leads out to members and reassigning them
WhatsApp	The WhatsApp channel and everything sent over it
Integrations	The connections to Facebook, Instagram, Google and the rest
Databases	The saved lists your team works from
Field Configuration	Which fields exist and how they behave

The rest carry their own names. The exact list is set per workspace, so yours may not match a colleague’s in a different company — work from what the editor shows you.

A permission the role has never been set for wears a Not Configured chip in the editor. Pick a level for it and the chip goes.

Where a role shows up elsewhere

Which Settings sections a member sees. Members, Roles and Channel access each need the matching permission — see Settings.
Which WhatsApp numbers they can use is a separate decision, in Channel access. A role grants the WhatsApp features; channel access grants the numbers.

If something goes wrong

What you see	Why	What to do
No bin on a role you want to delete	Somebody still holds it, or it is the workspace’s default role	Move those people onto another role first, then delete
No pencil on any row	Your role does not include editing roles	Ask a workspace owner
The Members column is all dashes	You cannot view Members	Ask an admin for view access to Members
A Read box is ticked and will not untick	Either it is one of the four permissions we keep read-on, or a write verb is granted	Remove the write verbs first if you really want read off
A row reads Custom	Its verbs match none of the four levels	Leave it, or pick a level to replace it
Not Configured on a permission	The role has never been given a level for it	Pick one — it defaults to nothing until you do
`Nothing matches “<query>”.`	The search found no role	Clear the Search roles box at the right of the tab row
You created a role and nobody has it	Assign members was skipped	Open Members, click a person, then Change role
Failed to create role. or Failed to update role.	The server refused the save	Try again; if it repeats, message support
Failed to load roles.	The list could not be fetched	Reload the page and reopen Settings
A workspace owner still cannot see Channel access	That one is also a plan limit, and being the owner does not lift a plan limit	Check your plan — see Subscription