Roles and permissions
Access control that is enforced where it counts
Agent, supervisor and admin roles live in a dedicated table and are checked on the server for every privileged call. Hiding a button is not security, so Hookdesk returns 403 instead of trusting the UI.
- Roles stored separately from profiles to prevent privilege escalation
- Server-side verification on security, billing and admin endpoints
- Permission matrix to toggle capabilities per role
- Global, group and restricted scopes for larger teams
Roles & permissions
Live in your workspace
- Database-enforced
- 403 by default
- Capability toggles
- Scopes
- Change history
Inside the workspace
What your team actually sees
Admin > Team holds the permission matrix: each capability against each role, with scope, saved instantly and enforced on the next request.
Good morning, Adam
Last 7 days9
Assigned to me
3
Due within 4h
1
SLA at risk
0
Unassigned
184
Resolved (7d)
4.7
CSAT (7d)
My queue - due first
- Invoice total looks wrong12m left
- Cannot sign in to the portalbreached
- Order SO-88213 never arrived1h 40m
- How do I add a teammate?3h 05m
Setup health
- Mailboxes connected3 syncing
- Routing rules active11
- Pending invites2
- Portallive at help.northwind.co
Capabilities
Built for this job, not bolted on
Database-enforced
Row-level security uses a security-definer role check, not client state.
403 by default
Privileged endpoints reject non-admin callers regardless of what the UI shows.
Capability toggles
Turn individual abilities on or off per role without code changes.
Scopes
Global, group or restricted access for teams that serve separate client sets.
Change history
Permission changes are auditable like any other admin action.
Invite flow
New teammates receive a role at invite time rather than after the fact.
How it runs
From arrival to answer
- 1
Invite
Add a teammate with an initial role.
- 2
Tune
Adjust capabilities in the permission matrix if the default is too wide.
- 3
Enforce
Every server call re-checks the role before doing the work.
- 4
Review
Audit the matrix periodically as the team grows.
Detail
The small print that matters
Where it lives
Admin > Team > Permissions.
Roles
Agent, supervisor, admin, plus portal customers who are outside the agent model entirely.
Enforcement
Server functions verify the caller's role; the database applies row-level security independently.
Related