/

Roles and permissions

The five system roles, what each can do, and how to choose between them.

3 min readUpdated August 2026

On this page

The five roles
What each can do
Choosing
Billing is Owner-only
Enforcement
Removing access

The five roles

Role	Summary
Owner	Everything, including billing and transferring the workspace
Admin	Everything except billing and org transfer
Manager	Runs the support operation; no billing or org settings
Agent	Works tickets; cannot change configuration
Viewer	Read-only

What each can do

Capability	Owner	Admin	Manager	Agent	Viewer
View and reply to tickets	Yes	Yes	Yes	Yes	View only
Assign and reassign tickets	Yes	Yes	Yes	Own only	No
View contacts	Yes	Yes	Yes	Yes	Yes
Edit contacts	Yes	Yes	Yes	Yes	No
Send campaigns	Yes	Yes	Yes	No	No
Edit knowledge base	Yes	Yes	Yes	No	No
Change Autopilot settings	Yes	Yes	Yes	No	No
Manage connections	Yes	Yes	No	No	No
Manage team and roles	Yes	Yes	No	No	No
View and manage billing	Yes	No	No	No	No
Transfer the workspace	Yes	No	No	No	No

Choosing

Give the least access that lets someone do their job. It is easy to raise later and awkward to explain after an accident.

New support hires → Agent. They can do the whole job of answering customers.
Team leads → Manager. Adds campaigns, knowledge, and Autopilot tuning.
Whoever configures integrations → Admin. Usually one or two people.
Analysts and stakeholders → Viewer. They can see everything and change nothing.

Resist making everyone an Admin because it is simpler. The most common real-world incident is not an attacker — it is a well-meaning colleague changing an Autopilot threshold or disconnecting a mailbox without realising the effect.

Billing is Owner-only

Only the Owner sees billing. This is not configurable. If the wrong person is Owner, transfer ownership rather than escalating everyone to Admin.

Enforcement

Permissions are enforced on the server, on every request, based on the identity of the caller. Hiding a button in the interface is a convenience, not the control — a user without permission cannot perform the action even if they construct the request directly.

Removing access

Removing someone from Settings → Team revokes access immediately. Their tickets remain and become unassigned; reassign their open work first.

Was this page helpful?

Invite your teamAdd teammates, choose the right role, and understand what each role can and cannot do.API keysCreate keys for programmatic access, and handle them without creating a security incident.Data and privacyWhat Kognit stores, how workspaces are isolated, and how to handle a deletion request.