Creating custom roles

Clone the closest role rather than starting empty, and design from what somebody must not do. The permissions sit in twelve sections.

Clone the closest role rather than starting empty, and design from what somebody must not do. The permissions sit in twelve sections, and on Enterprise this page is also where ticket access lives.

Create one

1. In Admin Center, click the People icon in the sidebar, then select Team > Roles.
2. To start from an existing role, hover over its row, click the options icon and select Clone. Otherwise click Create role.
3. Name it for the job it describes.
4. Work through the permission sections.
5. Assign it to one willing person and let them work a real day with it.

The twelve sections

Tickets, Custom objects, Assets, People, Channels, Agent workflow, Business rules, Omnichannel routing, Security and privacy, Help center, Analytics and Admin copilot.

Worth reading the list before you start, because two of them catch people out. Ticket access is under Tickets, which is why on Enterprise there is no such setting on the agent's profile. And the permission to install apps sits under Channels, not under anything that sounds like apps.

Design from the prohibitions

Ask what this person must not be able to do: delete tickets, export data, change triggers, see another team's work. Those are the decisions. Everything else can stay as the standard agent has it.

Starting from "what do they need" produces roles that grow until they are admin in all but name, one reasonable request at a time.

Test it with a real day

Assign it to one person and let them work normally. They will find the missing permission within the hour, which is faster and more honest than any checklist review.

Keep the number small

You can create up to 197 custom roles, which is not an invitation. Four or five is right for most organisations. A role per person is not access control, it is a maintenance burden nobody will keep accurate, and it makes every later change a survey.

Write one line per role saying who it is for and what it deliberately withholds. In a year that note is the difference between adjusting it confidently and leaving it alone because nobody dares.

See also

• Managing custom roles
• What the standard roles can do
• Setting ticket access per agent