Roles and permissions

Agent switches

Under Settings › People & access an admin can switch off six sensitive actions for agents. When a switch is off, only admins can do it:

• Resolve cases
• Change priority
• Change due dates
• Merge and split cases
• Forward cases by email
• Edit many cases at once

A settings change is confirmed only after the saved settings are read back. If confirmation fails, use Refresh before making another change; the last confirmed settings remain visible.

Custom staff roles

Under Settings › People & access › Custom staff roles, choose + New role, enter a name and description, and select its action permissions. Start blank (read-only) or choose the Read-only staff, Asset technician or Service desk supervisor template. Save role, then choose it in a staff member’s Role selector, or when adding staff. Existing Agent and Admin access is unchanged until an admin explicitly changes an assignment.

Custom roles use staff seats and retain normal staff visibility across the workspace, including other teams. Their switches restrict actions; they are not data-visibility scopes. Team filters do not secure data. Admin-only settings, billing, credentials and role management cannot be granted through a custom staff role. Ask and automated runbooks remain available only to the built-in Agent and Admin roles; custom staff use the module controls.

The agent switches above also limit custom roles. Sensitive case actions require both Work on cases and their individual switch. Assigned business approvals and CAB votes have a separate action permission and still require the person to be a valid approver; a role does not make someone an approver. Requesters can still approve their own assigned requests without becoming paid staff.

Changing a reusable role affects the next API request for its assigned staff. The portal refreshes role permissions periodically and on return to the tab. Changing someone’s role assignment ends their existing sessions so they sign in again. Every role or assignment change is audited. A role assigned to any staff account, including a removed account, cannot be deleted until it is reassigned. You can change a removed account’s role without restoring its access. Restore preserves its custom role. The last active admin cannot be demoted or removed, including through an invitation update or concurrent changes.

Staff without Work on cases are skipped by automatic assignment and cannot be picked as case owners. Applying this restriction returns their open case and unfinished task assignments to their queues; completed work is preserved. Granting case-work access later does not reassign old cases automatically.

Support groups

Groups (for example “Service Desk”, “Infrastructure”) let you route cases to a team instead of a person. A member sees the group's cases under Assigned to my team. See Assigning cases.