Roles and Permissions

Build roles that control what teammates can do and which customer records they can access.

Roles let you match careCycle access to the way your team actually works. Permissions control what someone can do. Data Filters control which customer records they can work with.

You manage roles from Settings > Organization > Users, Invites & Roles > Roles.

How Access Works

careCycle combines two kinds of access control:

Permissions control features and actions, such as viewing customers, transferring calls, cancelling appointments, or editing campaigns.
Data Filters limit records by NPN, so an agent can work only their own book or a manager can work the books of the NPNs assigned to them.

For Policies and Calls, Reporting: Self and Reporting: Organization separately control dashboard access and reporting scope. Record-list visibility does not automatically grant reporting access.

For ordinary record access, both checks are enforced on the server. A user needs the action permission and access to the target record.

Built-In Roles

Role	Typical use	Default record scope	Policies and Calls reporting
Owner	Agency principal	Full organization	Organization, including Self
Admin	Operations administrator	Full organization	Organization, including Self
Manager	Team or downline manager	Managed NPNs and directly assigned customers	Self
CSR	Service team	Full organization	Self
Agent	Producer or call agent	Own NPN and directly assigned customers	Self

Built-in roles are maintained by careCycle. Create a custom role when a team needs a different combination.

Reporting Access

Choose reporting permissions independently for CRM > Policies and Calling > Calls in the role editor.

Permission	Policies	Calls
View only	Policy lists and details; no policy dashboards	Call history and details; no call dashboards
Reporting: Self	Operations for the member's currently assigned customers' policies and their own work	Call Analytics for calls handled by the user
Reporting: Organization	Management, Placement, Carriers, and organization-wide Operations	Organization-wide Call Analytics and Inbound & Callbacks reporting

Both reporting permissions automatically enable the corresponding View permission. Reporting: Organization includes Self reporting, so selecting both is not necessary. Neither reporting permission grants the separate Edit, Delete, Export, or live-call control permissions.

Management requires Policies > Reporting: Organization. A role named Manager or Team Lead does not receive that access from its name. To give a manager organization reporting, create or edit a custom role with that permission and assign it to the member.

Calls > Reporting: Organization and Wallboard > View are independent. Grant Calls reporting for the Inbound & Callbacks dashboard. Grant Wallboard View separately for the live wallboard and its live-agent navigation link.

Reporting Scope And Data Filters

Reporting Self uses direct ownership: current customer assignment for policies, task assignment or the acting user for Operations activity, and the handling user for calls. It does not expand to the user's own NPN or managed NPNs.

Reporting Organization covers the active organization, including records outside the role's NPN-filtered record list. Report filters can narrow that scope, but cannot give a Self reporter access to someone else's work. Data Filters continue to apply to ordinary record lists independently.

Users only see dashboard tabs their reporting permissions allow. Without any reporting permission, Overview is hidden. Inaccessible saved links fall back to an allowed view without an access-denied toast.

Enable Reporting For A Role

On Roles, add a custom role or open an existing custom role's Edit action. Use a default role's copy button to start from that template.
Under Permissions > CRM > Policies, select Reporting: Self or Reporting: Organization as needed.
Under Permissions > Calling > Calls, select the reporting level separately.
Save the role. Existing members assigned to that role receive its updated access after the normal permission-cache refresh.
On Users, choose the role in the member's Role selector. On Invites, select the role when inviting a new member.

Existing custom roles do not automatically gain reporting permissions from View, Wallboard access, or a role name. Enable the desired reporting level explicitly.

For integrations and permission inspection, the capability identifiers are:

Editor option	Capability
Policies > Reporting: Self	`customer_policies.reporting_self`
Policies > Reporting: Organization	`customer_policies.reporting_org`
Calls > Reporting: Self	`calls.reporting_self`
Calls > Reporting: Organization	`calls.reporting_org`

Create A Custom Role

Open Settings > Organization > Users, Invites & Roles.
Open Roles.
Select Create Custom Role.
Enter a name and description.
Optionally start from a built-in template.
Choose permissions by feature area.
Configure Data Filters if the role should see only part of the book.
Select Create Role.
Assign the role to members from the Users tab.

Custom roles do not continue inheriting from their template. A template copies its current settings into the new role, which you can then customize.

Permission Areas

The permission editor groups options into six feature areas.

CRM

Customers

Option	What it enables
View	View customer lists and customer details within the role's Data Filters
Create	Create customer records
Edit	Update customer fields
Assign	Assign or reassign customers to team members
Delete	Soft-delete customers so they disappear from normal workflows while history is retained
Import	Import a book of business
Export	Export customer data

Customer Delete is intentionally high risk. It is granted to built-in Owner and Admin roles by default, not to built-in Agent, CSR, or Manager roles.

Policies

Option	What it enables
View	View policy lists and details
Create	Add policies
Edit	Update policies
Delete	Soft-delete policies
Export	Export policies
Reporting: Self	View Operations for the member's assigned policies and work
Reporting: Organization	View Management, Placement, Carriers, and organization-wide Operations; includes Self reporting

Customer Contact Info

View reveals unredacted phone numbers, email addresses, and other protected contact information. Without it, applicable contact details are redacted.

Attachments

Option	What it enables
View	View customer and policy documents
Upload	Upload documents
Update	Replace or update attachment details
Delete	Delete attachments

Notes

Notes are currently part of baseline Inbox access for active members. The Notes permission family remains available for forward compatibility as note access is made more granular.

Customer Automations

View, edit, or delete organization-wide customer automation rules.

Calling

Softphone

Option	What it enables
Use	Make, receive, recover, and disposition calls
Transfer	Transfer an active call; also enables Use
Listen	Silently listen to a live call
Barge	Join a live call and speak; also enables Listen

Listen and Barge do not automatically grant Wallboard access.

Calls

Option	What it enables
View	View call history, details, and recordings in the user's data scope
Export	Export calls and download protected recordings
Reporting: Self	View Call Analytics for calls handled by the user
Reporting: Organization	View organization-wide Call Analytics and Inbound & Callbacks; includes Self reporting

Scripts

Option	What it enables
View	View available script definitions
Edit	Design and configure scripts
Submit	Save the customer, policy, and custom-field entries represented by the form during a call

Submit does not allow unrestricted customer or policy changes. It applies only the fields included in the resolved script.

Softphone Routing

Option	What it enables
View	View agent routing within softphone routing groups
Edit	Change routing agents, groups, and routing behavior

Phone Numbers

Option	What it enables
View	View phone numbers and assignments
Manage	Procure, assign, enable, disable, and configure numbers

Phone Suppression

Use Calling > Phone Suppression to control access to the organization's unwanted-caller list.

Option	What it enables	Capability
View	Search suppressed numbers and review their status, history, and recorded activity	`phone_suppression.view`
Configure	Read and configure automatic suppression policies for selectable library or custom dispositions	`phone_suppression.configure`
Manage	Add individual numbers to the suppression list or remove their suppression	`phone_suppression.manage`
Import	Upload, validate, and import a CSV list of numbers	`phone_suppression.import`
Export	Create and download filtered CSV exports	`phone_suppression.export`

Configure changes the automation; Manage changes individual numbers. An operator can manage the list without permission to change which dispositions automatically suppress callers. Updating a suppression policy also requires Campaigns > Edit (campaigns.edit). Import and Export are separate from Manage; one does not grant the others.

The built-in Owner and Admin roles have all five permissions. Built-in Agent, CSR, and Manager roles have none by default. Grant the needed actions through a custom role. Selecting Configure, Manage, Import, or Export also enables View.

Agents do not need suppression administration permissions just to select a call disposition whose suppression policy an administrator already configured. The policy is applied when that call is finalized.

Suppression is organization-wide, including numbers without customer records. Viewing the Customers tab within a suppression additionally requires Customers > View and Customer Contact Info > View, with normal record visibility filters. Suppression permissions do not clear independent Do Not Call, Do Not SMS, or carrier opt-outs.

See Suppress Unwanted Callers for the workflows and CSV format.

Live Ops

Wallboard

Option	What it enables
View	View live calls, queues, staffing, and routing status
Export	Export wallboard and productivity reports

Wallboard View is read-only. Status and routing changes have separate permissions. Wallboard View does not grant Calls Reporting, and Calls Reporting does not grant Wallboard View.

Status Overrides

Option	What it enables
Agent	Change another online agent between Available and Busy
Campaign	Temporarily take an agent on or off air for one campaign

Campaign status override does not remove the agent from the campaign's routing pool and does not affect other campaigns.

Routing Overrides

Option	What it enables
Source Enablement	Temporarily pause routing for one campaign-source path
Agent Source	Temporarily block one agent from one campaign-source path

These are temporary operational controls. They do not change the source's canonical campaign assignment.

Admin Dashboard

View opens the main Dashboard at /dashboard with its organization-wide Acquisition and Customer engagement reporting. Without this permission, the same page shows the personal agent dashboard with action items, today's queue, upcoming appointments, and personal metrics.

This permission also authorizes the reporting APIs used by those dashboard views. It does not grant Policies reporting, Calls reporting, or live Wallboard access. Those use the separate Policies and Calls Reporting: Self / Reporting: Organization permissions and Wallboard > View.

Campaigns

Campaigns Edit is full campaign configuration access. It includes viewing and editing Pulse, enrollment automations, sources, routing groups, scripts, calendars, phone numbers, and campaign enrollment. It also includes organization calling settings and call reporting needed to configure and review campaigns. These dependent grants stay selected while Campaigns Edit is enabled.

Shared resources and organization calling settings can affect other campaigns. This permission is broader than editing one campaign's name. It does not grant billing management, role administration, member deletion, SSN reveal, or live-call monitoring/barge. Ordinary record filters remain independently enforced. View-only campaigns do not receive these configuration writes.

Option	What it enables
View	View campaigns and campaign details
Edit	Create and fully configure campaigns through the bundled permissions above

Campaign export is not a separate permission. Pulse workflow export is managed under Pulse Workflows.

Pulse Workflows

Option	What it enables
View	View Pulse workflow definitions
Edit	Build and update workflows
Export	Download workflow JSON

Campaign Enrollment

Manage adds customers to campaigns and manages enrollment lifecycle actions, without automatically granting full campaign editing.

Sources

Option	What it enables
View	View source definitions and campaign assignments
Edit	Create and update sources and assignments
Delete	Delete eligible sources

Some source-management screens also require the corresponding Campaign permission because assignments connect the two features.

Campaign Automations

View, edit, or delete campaign automation rules.

Work

Appointments

Option	What it enables
View	View appointment lists, details, and activity
Create	Preview availability and book appointments
Edit	Reschedule, cancel, complete, or mark appointments as no-show
Assign	Assign, reassign, or unassign appointments

Unavailable actions stay visible but disabled where useful, so users can see what requires additional access.

Calendars

Option	What it enables
View	View reusable booking calendars
Create	Create or duplicate configurations
Edit	Edit configuration, routing, availability, and workflows
Delete	Delete configurations that are not in use

Tasks

Option	What it enables
View	View tasks and task tags
Edit	Create and update tasks and tags
Delete	Delete tasks and tags

Task Automations

View, edit, or delete task automation rules.

Inquiries

Option	What it enables
View	View inquiries
Resolve	Work and resolve inquiry workflows
Assign	Assign inquiries to team members
Export	Export inquiry data

Ask

Option	What it enables
View	Use Ask careCycle and saved reports
Export	Export generated report tables

Admin

Billing

Option	What it enables
View	View billing, usage, and subscription details
Edit	Change supported billing settings

Developer Settings

Option	What it enables
View	View API keys, webhooks, and organization integrations
Edit	Create, rotate, update, and revoke supported developer resources

Organization

Option	What it enables
View	View organization settings
Update	Change organization settings
Delete	Perform supported destructive organization actions

Members

Option	What it enables
View	View the organization member-management area
Create	Add supported member records
Update	Change member roles and access
Delete	Remove members

Invitations

Option	What it enables
Create	Invite or resend invitations
Cancel	Revoke pending invitations

Access Control

Option	What it enables
Read	View custom roles
Create	Create custom roles
Update	Edit custom roles
Delete	Delete unassigned custom roles

Assigned custom roles cannot be renamed or deleted until members are reassigned.

Data Filters

Data Filters determine which records a role can see after a permission allows the feature.

Filter	Meaning
Own NPN	The member sees records for their own NPN and directly assigned customers where applicable
Managed NPNs	The member sees records for the NPNs configured on their user account and direct assignments where applicable

Filters are available for:

Customers
Calls
Policies
Attachments

After assigning a Managed NPN role, open the member's action menu and choose Configure Access to select the NPNs they manage.

Removing a resource's View permission also removes its Data Filter because a scope without feature access has no effect.

Policies and Calls reporting have their own explicit Self and Organization permissions. NPN Data Filters do not narrow Organization reporting or expand Self reporting. See Reporting Access.

Permission Dependencies

careCycle automatically adds prerequisites in several cases:

Most Edit, Delete, Export, and Manage actions also enable View.
Softphone Transfer also enables Use.
Softphone Barge also enables Listen.
Reporting: Self and Reporting: Organization also enable the resource's View.
Reporting: Organization includes Self reporting access without requiring a separate Self selection.

The selected count includes implied permissions.

Recommended Role Design

Start With The Job, Not The Person

Create roles such as:

Licensed Agent
Customer Service Representative
Team Lead
Call Supervisor
Billing Administrator

Avoid one-off roles named after a specific person.

Grant The Smallest Useful Set

Start with the actions required for the job. Add permissions after a real need is identified instead of enabling every feature in advance.

Separate Read From Operational Control

Examples:

Wallboard View does not grant status overrides.
Listen does not grant Barge.
Appointment View does not grant Edit.
Scripts View does not grant Submit or Edit.

Use Data Filters For Book Segmentation

Do not create a different feature role for every downline when the only difference is record scope. Reuse the role and configure member-specific Managed NPNs.

Review High-Risk Permissions

Review these carefully:

Delete Customers
Delete Policies
Export customer or call data
View Customer Contact Info
Listen or Barge into calls
Status and routing overrides
Developer Settings Edit
Access Control Create, Update, or Delete

Changes And Propagation

Permission changes normally appear quickly, but an already open browser may take up to approximately one minute to refresh effective access. Refresh the page if a role change does not appear immediately.

When a user's access is removed:

Navigation updates after permissions refresh.
Disabled controls prevent new actions.
The server still rejects unauthorized requests immediately after its short authorization cache refreshes.

FAQs

Why can a user view policies or calls but not see dashboard tabs?

View grants record access. Add Reporting: Self or Reporting: Organization under Policies or Calls to enable reporting. Management, Placement, and Carriers require Policies Reporting: Organization. Inbound & Callbacks requires Calls Reporting: Organization.

Invite Your Team

Agent Availability

Wallboard

SOC 2 and HIPAA

On this page