Enterprise RBAC & Granular Access Control
Configure role-based access control (RBAC), custom roles, refund limits, and module-level permission scopes.
On this page
Kognit includes an enterprise-grade Role-Based Access Control (RBAC) engine that lets you configure fine-grained permissions across your entire team, whether managing ecommerce support agents, SaaS engineers, or external call center staff.
Permission Modules
Permissions in Kognit are organized across 11 functional modules:
| Module | Scope | Example Actions |
|---|---|---|
| Inbox & Messaging | Conversations, notes, and routing | inbox:read, inbox:write, inbox:assign, inbox:delete |
| Tickets & Lifecycle | Ticket status, priority, and SLA | ickets:read, ickets:escalate, ickets:assign |
| Refunds & Financials | Store credit, cancellations, refunds | efund:view, efund:process, efund:approve_limit |
| Shopify / Orders | Customer orders, inventory lookup | order:read, order:cancel, order:sync |
| Marketing & Campaigns | WhatsApp broadcasts, SMS, ads | campaigns:read, campaigns:create, campaigns:send |
| Customers & CRM | Contact details, customer 360 data | customers:read, customers:export, customers:edit |
| AI & Autopilot | AI brain, model tuning, prompt rules | i:view_rules, i:tune_thresholds, i:ingest |
| Analytics & Export | CSAT, resolution metrics, CSV export | nalytics:view, nalytics:export |
| Settings & Security | API keys, team members, integrations | settings:manage, settings:api_keys, dmin:audit_logs |
Financial Guardrails: Refund Approval Limits
To prevent unauthorized store payouts or rogue discounts, you can enforce hard financial caps per role:
- Tier-1 Support Agent: Max refund allowance $0 (drafts refund for supervisor approval).
- Support Team Lead / Manager: Up to $50 per order.
- Store Admin / Owner: Unlimited refund authority.
Attempts to process refunds above an agent's configured limit are automatically routed to a manager's approval queue.
Custom Roles & Department Isolation
Organizations can create custom role templates:
- Navigate to Settings -> Access Control (/helpdesk/access-control).
- Click + Create Custom Role.
- Select the exact module checkboxes required for the job function (e.g. External BPO Agent, Billing Specialist, Product QA).
- Save and assign to team members.
Audit Logs & Security Tracing
Every critical security event is permanently written to your immutable audit log:
- Member permission changes and role assignments.
- AI Autopilot confidence threshold modifications.
- API key generation and channel disconnections.
See Roles and Permissions Overview for standard system roles.
Related