Understand roles and permissions

Every active workspace membership has one of four roles: owner, admin, member, or viewer. A role expands to server permissions; protected routes accept one or more exact permissions appropriate to the workspace type.

Current standard-workspace permissions

Area	Owner	Admin	Member	Viewer
Read workspace	Yes	Yes	Yes	Yes
Manage workspace identity and settings	Yes	Yes through the current shared settings check	No	No
Manage team members	Yes	Yes	No	No
Manage agents	Yes	Yes	Yes	No
View calls	Yes	Yes	Yes	Yes
Manage knowledge bases	Yes	Yes	No	No
Manage phone numbers	Yes	Yes	No	No
Manage integrations and functions	Yes	Yes	No	No
View or manage workspace billing	Yes	No	No	No
Delete the workspace	Yes	Yes through the current shared manage check	No	No

This matrix reflects the current server implementation. The Team screen's short descriptions currently say that Admin can view billing and Member can use all features; those summaries are broader than the enforced permissions. Treat a server Forbidden response and the matrix above as authoritative.

Agency and subaccount permissions

Owners receive every agency and subaccount permission. Admins can manage agency branding, plans, subaccounts, support-dashboard access, subaccount agents, knowledge, integrations, users, and settings, but do not receive agency or subaccount billing permissions.

Members can read subaccounts, manage subaccount agents, and view subaccount calls, analytics, and usage. Viewers can read subaccounts and view calls, analytics, and usage. Billing remains owner-only under the current mapping.

Permissions are checked per operation

Frontend controls can hide or disable actions, but the server repeats the check. Resource routes also verify that the target resource belongs to the authorized workspace. A model response, copied workspace ID, browser storage entry, or manually edited URL cannot grant access.

Choose least privilege

• Use Viewer for observation and reporting.
• Use Member when someone must operate agents and review calls without changing shared configuration.
• Use Admin for day-to-day configuration and team management without billing access.
• Reserve Owner for billing, ownership, and full administrative control.

Review roles when responsibilities change and remove memberships that are no longer required.