Plan requirement
| Subscription | Suite Team or higher, Support Team or higher |
| Access | Admin |
It depends on their ticket access, not on their group membership. Two settings people expect to be one.
Can they see other groups' tickets?
An agent set to see all tickets sees every group's work, whether or not they are a member. An agent set to their own groups sees only those.
Group membership decides what is routed to them. Ticket access decides what they can open.
If you just discovered this
That an agent can read another team's tickets is not a fault. It is the default access, broader than anyone deliberately chose.
So the question is not how to repair it, but whether you want to narrow it.
Where do I check it?
The two settings, and where each one lives
In Admin Center, click People in the sidebar, select Team > Team members and open the person. Their group membership is on the profile.
Their ticket access depends on the plan. Below Enterprise it is on the profile alongside the groups. On Enterprise it is not there at all: permissions come from the agent's custom role, so open the role instead. Knowing where to look is most of the work.
Group-based is the sensible default
Broad enough to collaborate, narrow enough that one compromised account does not expose the whole account. All tickets should be a decision about specific people.
Private groups are the exception
Tickets in a private group are hidden even from agents with access to all tickets. That is the only setting that overrides it, and it is what HR or legal work needs.
Check it after reorganisations
People move teams and keep the access from the old one. Nobody reports having too much access, so it is only found by looking.
Comments
0 comments
Article is closed for comments.