A role is a named bundle of permissions. Natiq never checks someone's role name — it checks the permissions inside it, and you grant a role to people. Use the built-in roles for common jobs, and create a custom role when none fits.
How roles decide what you see
Each product on the rail opens with one read permission — for example the Inbox needs liveagent.conversations:read. A person without it doesn't see the product in the rail and can't open it by link. People who hold none of them see No products available and are asked to contact an organization administrator. The full list of keys is in the permission reference.
A person can hold several roles; their access is what the roles grant together.
The built-in roles
Open Settings, then Roles and permissions. The built-in roles carry a System badge with a lock: they're managed by Natiq and can't be edited or deleted.
- 1New role
| Role | What it's for |
|---|---|
| Organization admin | Full access to every product and setting in this organization. |
| Inbox admin | Runs the inbox end to end — conversations, teams, agents, queues, settings and reports. |
| Inbox agent | Handles their own conversations. No routing, reports or queue configuration. |
| Campaigns admin | Creates, schedules and reports on campaigns, the contacts they target, and WhatsApp Flows. |
| Agent Builder admin | Builds and publishes bots, their queue routes, flow analytics and WhatsApp Flows. |
A sixth role, Platform admin, is for Natiq's own staff. It isn't grantable inside an organization and is hidden from the pickers.
Each role card shows how many people hold it (for example "3 people"). If you hold admin:audit, a History link opens that role's entries in the audit log. The same link is in the footer of the role drawer.
Create a custom role
You need admin:write.
- 1Presets
- 2Summary
Open Settings → Roles and permissions and select New role.
Type the role's name where it says Name this role…. Select Add description if you want to say what it's for.
Under Start from, pick a starting point: Blank, any existing role to copy, Inbox supervisor or Read-only. You can change everything afterwards.
In Permissions, set a level for each resource. Resources are grouped under Workspace, Live agent, Campaigns, Builder, Widget and Whatsapp. Use Search resources… to find one.
Check the footer, which summarises the role — for example "5 resources · 2 areas".
Select Create role. The button stays disabled until the role has a name and at least one permission.
Setting levels
Every resource has a segmented control:
- None — no access.
- Read — see it.
- Write — change it. Write includes Read, so a role that can write can always read.
A few resources are read-only and offer only None and Read. Some resources also show extra chips once access isn't None — for example Assign on tickets or Schedule on campaigns. They grant a specific action on top of Read or Write; select a chip to turn it on. Admin has an audit chip (the audit log) and Bots has a trigger chip (running flows by hand).
On each group header, Read all sets every resource in the group to Read, and Clear sets them back to None.
About "Inbox supervisor" and "Read-only"
These aren't roles; they're starting points. Inbox supervisor begins with what's needed to work and redistribute tickets, watch the live board, open the tickets behind report figures and receive SLA breach alerts, with read-only sight of the configuration. Read-only sets every resource to Read. Either way, you save a custom role of your own and can adjust it later.
Edit or delete a custom role
Custom roles have Edit and a delete button. Editing opens the same drawer, titled Edit role, with Save.
Deleting asks you to confirm — "Users holding it lose its permissions." — so check the people count on the card first.
Give the role to people
A new role shows up in the role lists on the Users tab and in the invitation drawer. See Manage users and Invite teammates.