# Roles and Permissions (/docs/guides/run-your-team/roles-and-permissions)
Roles let you match careCycle access to the way your team actually works.
Permissions control **what someone can do**. Data Filters control **which
customer records they can work with**.
You manage roles from **Settings > Organization > Users, Invites & Roles >
Roles**.
How Access Works [#how-access-works]
careCycle combines two kinds of access control:
* **Permissions** control features and actions, such as viewing customers,
transferring calls, cancelling appointments, or editing campaigns.
* **Data Filters** limit records by NPN, so an agent can work only their own
book or a manager can work the books of the NPNs assigned to them.
For Policies and Calls, **Reporting: Self** and **Reporting: Organization**
separately control dashboard access and reporting scope. Record-list visibility
does not automatically grant reporting access.
For ordinary record access, both checks are enforced on the server. A user needs
the action permission and access to the target record.
Built-In Roles [#built-in-roles]
| Role | Typical use | Default record scope | Policies and Calls reporting |
| ----------- | ------------------------ | -------------------------------------------- | ---------------------------- |
| **Owner** | Agency principal | Full organization | Organization, including Self |
| **Admin** | Operations administrator | Full organization | Organization, including Self |
| **Manager** | Team or downline manager | Managed NPNs and directly assigned customers | Self |
| **CSR** | Service team | Full organization | Self |
| **Agent** | Producer or call agent | Own NPN and directly assigned customers | Self |
Built-in roles are maintained by careCycle. Create a custom role when a team
needs a different combination.
Reporting Access [#reporting-access]
Choose reporting permissions independently for **CRM > Policies** and
**Calling > Calls** in the role editor.
| Permission | Policies | Calls |
| --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| **View only** | Policy lists and details; no policy dashboards | Call history and details; no call dashboards |
| **Reporting: Self** | Operations for the member's currently assigned customers' policies and their own work | Call Analytics for calls handled by the user |
| **Reporting: Organization** | Management, Placement, Carriers, and organization-wide Operations | Organization-wide Call Analytics and Inbound & Callbacks reporting |
Both reporting permissions automatically enable the corresponding **View**
permission. **Reporting: Organization includes Self reporting**, so selecting
both is not necessary. Neither reporting permission grants the separate Edit,
Delete, Export, or live-call control permissions.
**Management requires Policies > Reporting: Organization.** A role named
Manager or Team Lead does not receive that access from its name. To give a
manager organization reporting, create or edit a custom role with that permission
and assign it to the member.
**Calls > Reporting: Organization and Wallboard > View are independent.**
Grant Calls reporting for the Inbound & Callbacks dashboard. Grant Wallboard View
separately for the live wallboard and its live-agent navigation link.
Reporting Scope And Data Filters [#reporting-scope-and-data-filters]
Reporting Self uses direct ownership: current customer assignment for policies,
task assignment or the acting user for Operations activity, and the handling user
for calls. It does not expand to the user's own NPN or managed NPNs.
Reporting Organization covers the active organization, including records outside
the role's NPN-filtered record list. Report filters can narrow that scope, but
cannot give a Self reporter access to someone else's work. Data Filters continue
to apply to ordinary record lists independently.
Users only see dashboard tabs their reporting permissions allow. Without any
reporting permission, Overview is hidden. Inaccessible saved links fall back to
an allowed view without an access-denied toast.
Enable Reporting For A Role [#enable-reporting-for-a-role]
1. On **Roles**, add a custom role or open an existing custom role's **Edit** action.
Use a default role's copy button to start from that template.
2. Under **Permissions > CRM > Policies**, select **Reporting: Self** or
**Reporting: Organization** as needed.
3. Under **Permissions > Calling > Calls**, select the reporting level separately.
4. Save the role. Existing members assigned to that role receive its updated access
after the normal permission-cache refresh.
5. On **Users**, choose the role in the member's Role selector. On **Invites**,
select the role when inviting a new member.
Existing custom roles do not automatically gain reporting permissions from View,
Wallboard access, or a role name. Enable the desired reporting level explicitly.
For integrations and permission inspection, the capability identifiers are:
| Editor option | Capability |
| ---------------------------------- | ---------------------------------- |
| Policies > Reporting: Self | `customer_policies.reporting_self` |
| Policies > Reporting: Organization | `customer_policies.reporting_org` |
| Calls > Reporting: Self | `calls.reporting_self` |
| Calls > Reporting: Organization | `calls.reporting_org` |
Create A Custom Role [#create-a-custom-role]
1. Open **Settings > Organization > Users, Invites & Roles**.
2. Open **Roles**.
3. Select **Create Custom Role**.
4. Enter a name and description.
5. Optionally start from a built-in template.
6. Choose permissions by feature area.
7. Configure Data Filters if the role should see only part of the book.
8. Select **Create Role**.
9. Assign the role to members from the Users tab.
Custom roles do not continue inheriting from their template. A template copies
its current settings into the new role, which you can then customize.
Permission Areas [#permission-areas]
The permission editor groups options into six feature areas.
CRM [#crm]
Customers [#customers]
| Option | What it enables |
| ---------- | --------------------------------------------------------------------------------------- |
| **View** | View customer lists and customer details within the role's Data Filters |
| **Create** | Create customer records |
| **Edit** | Update customer fields |
| **Assign** | Assign or reassign customers to team members |
| **Delete** | Soft-delete customers so they disappear from normal workflows while history is retained |
| **Import** | Import a book of business |
| **Export** | Export customer data |
Customer Delete is intentionally high risk. It is granted to built-in Owner
and Admin roles by default, not to built-in Agent, CSR, or Manager roles.
Policies [#policies]
| Option | What it enables |
| --------------------------- | ----------------------------------------------------------------------------------------------- |
| **View** | View policy lists and details |
| **Create** | Add policies |
| **Edit** | Update policies |
| **Delete** | Soft-delete policies |
| **Export** | Export policies |
| **Reporting: Self** | View Operations for the member's assigned policies and work |
| **Reporting: Organization** | View Management, Placement, Carriers, and organization-wide Operations; includes Self reporting |
Customer Contact Info [#customer-contact-info]
**View** reveals unredacted phone numbers, email addresses, and other protected
contact information. Without it, applicable contact details are redacted.
Attachments [#attachments]
| Option | What it enables |
| ---------- | ------------------------------------ |
| **View** | View customer and policy documents |
| **Upload** | Upload documents |
| **Update** | Replace or update attachment details |
| **Delete** | Delete attachments |
Notes [#notes]
Notes are currently part of baseline Inbox access for active members. The Notes
permission family remains available for forward compatibility as note access is
made more granular.
Customer Automations [#customer-automations]
View, edit, or delete organization-wide customer automation rules.
Calling [#calling]
Softphone [#softphone]
| Option | What it enables |
| ------------ | ----------------------------------------------- |
| **Use** | Make, receive, recover, and disposition calls |
| **Transfer** | Transfer an active call; also enables Use |
| **Listen** | Silently listen to a live call |
| **Barge** | Join a live call and speak; also enables Listen |
Listen and Barge do not automatically grant Wallboard access.
Calls [#calls]
| Option | What it enables |
| --------------------------- | -------------------------------------------------------------------------------------- |
| **View** | View call history, details, and recordings in the user's data scope |
| **Export** | Export calls and download protected recordings |
| **Reporting: Self** | View Call Analytics for calls handled by the user |
| **Reporting: Organization** | View organization-wide Call Analytics and Inbound & Callbacks; includes Self reporting |
Scripts [#scripts]
| Option | What it enables |
| ---------- | ----------------------------------------------------------------------------------------- |
| **View** | View available script definitions |
| **Edit** | Design and configure scripts |
| **Submit** | Save the customer, policy, and custom-field entries represented by the form during a call |
Submit does not allow unrestricted customer or policy changes. It applies only
the fields included in the resolved script.
Softphone Routing [#softphone-routing]
| Option | What it enables |
| -------- | --------------------------------------------------- |
| **View** | View agent routing within softphone routing groups |
| **Edit** | Change routing agents, groups, and routing behavior |
Phone Numbers [#phone-numbers]
| Option | What it enables |
| ---------- | ------------------------------------------------------- |
| **View** | View phone numbers and assignments |
| **Manage** | Procure, assign, enable, disable, and configure numbers |
Phone Suppression [#phone-suppression]
Use **Calling > Phone Suppression** to control access to the organization's
unwanted-caller list.
| Option | What it enables | Capability |
| ------------- | ----------------------------------------------------------------------------------------------- | ----------------------------- |
| **View** | Search suppressed numbers and review their status, history, and recorded activity | `phone_suppression.view` |
| **Configure** | Read and configure automatic suppression policies for selectable library or custom dispositions | `phone_suppression.configure` |
| **Manage** | Add individual numbers to the suppression list or remove their suppression | `phone_suppression.manage` |
| **Import** | Upload, validate, and import a CSV list of numbers | `phone_suppression.import` |
| **Export** | Create and download filtered CSV exports | `phone_suppression.export` |
**Configure changes the automation; Manage changes individual numbers.** An
operator can manage the list without permission to change which dispositions
automatically suppress callers. Updating a suppression policy also requires
**Campaigns > Edit** (`campaigns.edit`). Import and Export are separate from
Manage; one does not grant the others.
The built-in **Owner** and **Admin** roles have all five permissions. Built-in
**Agent**, **CSR**, and **Manager** roles have none by default. Grant the needed
actions through a custom role. Selecting Configure, Manage, Import, or Export
also enables View.
Agents do not need suppression administration permissions just to select a call
disposition whose suppression policy an administrator already configured. The
policy is applied when that call is finalized.
Suppression is organization-wide, including numbers without customer records.
Viewing the **Customers** tab within a suppression additionally requires
**Customers > View** and **Customer Contact Info > View**, with normal record
visibility filters. Suppression permissions do not clear independent Do Not Call,
Do Not SMS, or carrier opt-outs.
See [Suppress Unwanted Callers](/docs/guides/phone-numbers/suppress-unwanted-callers)
for the workflows and CSV format.
Live Ops [#live-ops]
Wallboard [#wallboard]
| Option | What it enables |
| ---------- | ----------------------------------------------------- |
| **View** | View live calls, queues, staffing, and routing status |
| **Export** | Export wallboard and productivity reports |
Wallboard View is read-only. Status and routing changes have separate
permissions. Wallboard View does not grant Calls Reporting, and Calls Reporting
does not grant Wallboard View.
Status Overrides [#status-overrides]
| Option | What it enables |
| ------------ | -------------------------------------------------------- |
| **Agent** | Change another online agent between Available and Busy |
| **Campaign** | Temporarily take an agent on or off air for one campaign |
Campaign status override does not remove the agent from the campaign's routing
pool and does not affect other campaigns.
Routing Overrides [#routing-overrides]
| Option | What it enables |
| --------------------- | --------------------------------------------------------- |
| **Source Enablement** | Temporarily pause routing for one campaign-source path |
| **Agent Source** | Temporarily block one agent from one campaign-source path |
These are temporary operational controls. They do not change the source's
canonical campaign assignment.
Admin Dashboard [#admin-dashboard]
**View** opens the main Dashboard at `/dashboard` with its organization-wide
**Acquisition** and **Customer engagement** reporting. Without this permission, the same page
shows the personal agent dashboard with action items, today's queue, upcoming
appointments, and personal metrics.
This permission also authorizes the reporting APIs used by those dashboard views. It does
not grant Policies reporting, Calls reporting, or live Wallboard access. Those
use the separate Policies and Calls **Reporting: Self / Reporting: Organization**
permissions and **Wallboard > View**.
Campaigns [#campaigns]
Campaigns [#campaigns-1]
**Campaigns Edit is full campaign configuration access.** It includes viewing
and editing Pulse, enrollment automations, sources, routing groups, scripts,
calendars, phone numbers, and campaign enrollment. It also includes organization
calling settings and call reporting needed to configure and review campaigns.
These dependent grants stay selected while Campaigns Edit is enabled.
Shared resources and organization calling settings can affect other campaigns.
This permission is broader than editing one campaign's name. It does not grant
billing management, role administration, member deletion, SSN reveal, or live-call
monitoring/barge. Ordinary record filters remain independently enforced.
View-only campaigns do not receive these configuration writes.
| Option | What it enables |
| -------- | -------------------------------------------------------------------------- |
| **View** | View campaigns and campaign details |
| **Edit** | Create and fully configure campaigns through the bundled permissions above |
Campaign export is not a separate permission. Pulse workflow export is managed
under Pulse Workflows.
Pulse Workflows [#pulse-workflows]
| Option | What it enables |
| ---------- | ------------------------------- |
| **View** | View Pulse workflow definitions |
| **Edit** | Build and update workflows |
| **Export** | Download workflow JSON |
Campaign Enrollment [#campaign-enrollment]
**Manage** adds customers to campaigns and manages enrollment lifecycle actions,
without automatically granting full campaign editing.
Sources [#sources]
| Option | What it enables |
| ---------- | ------------------------------------------------ |
| **View** | View source definitions and campaign assignments |
| **Edit** | Create and update sources and assignments |
| **Delete** | Delete eligible sources |
Some source-management screens also require the corresponding Campaign
permission because assignments connect the two features.
Campaign Automations [#campaign-automations]
View, edit, or delete campaign automation rules.
Work [#work]
Appointments [#appointments]
| Option | What it enables |
| ---------- | ------------------------------------------------------------- |
| **View** | View appointment lists, details, and activity |
| **Create** | Preview availability and book appointments |
| **Edit** | Reschedule, cancel, complete, or mark appointments as no-show |
| **Assign** | Assign, reassign, or unassign appointments |
Unavailable actions stay visible but disabled where useful, so users can see
what requires additional access.
Calendars [#calendars]
| Option | What it enables |
| ---------- | -------------------------------------------------------- |
| **View** | View reusable booking calendars |
| **Create** | Create or duplicate configurations |
| **Edit** | Edit configuration, routing, availability, and workflows |
| **Delete** | Delete configurations that are not in use |
Tasks [#tasks]
| Option | What it enables |
| ---------- | -------------------------------- |
| **View** | View tasks and task tags |
| **Edit** | Create and update tasks and tags |
| **Delete** | Delete tasks and tags |
Task Automations [#task-automations]
View, edit, or delete task automation rules.
Inquiries [#inquiries]
| Option | What it enables |
| ----------- | ---------------------------------- |
| **View** | View inquiries |
| **Resolve** | Work and resolve inquiry workflows |
| **Assign** | Assign inquiries to team members |
| **Export** | Export inquiry data |
Ask [#ask]
| Option | What it enables |
| ---------- | ----------------------------------- |
| **View** | Use Ask careCycle and saved reports |
| **Export** | Export generated report tables |
Admin [#admin]
Billing [#billing]
| Option | What it enables |
| -------- | --------------------------------------------- |
| **View** | View billing, usage, and subscription details |
| **Edit** | Change supported billing settings |
Developer Settings [#developer-settings]
| Option | What it enables |
| -------- | ---------------------------------------------------------------- |
| **View** | View API keys, webhooks, and organization integrations |
| **Edit** | Create, rotate, update, and revoke supported developer resources |
Organization [#organization]
| Option | What it enables |
| ---------- | -------------------------------------------------- |
| **View** | View organization settings |
| **Update** | Change organization settings |
| **Delete** | Perform supported destructive organization actions |
Members [#members]
| Option | What it enables |
| ---------- | -------------------------------------------- |
| **View** | View the organization member-management area |
| **Create** | Add supported member records |
| **Update** | Change member roles and access |
| **Delete** | Remove members |
Invitations [#invitations]
| Option | What it enables |
| ---------- | ---------------------------- |
| **Create** | Invite or resend invitations |
| **Cancel** | Revoke pending invitations |
Access Control [#access-control]
| Option | What it enables |
| ---------- | ------------------------------ |
| **Read** | View custom roles |
| **Create** | Create custom roles |
| **Update** | Edit custom roles |
| **Delete** | Delete unassigned custom roles |
Assigned custom roles cannot be renamed or deleted until members are reassigned.
Data Filters [#data-filters]
Data Filters determine which records a role can see after a permission allows
the feature.
| Filter | Meaning |
| ---------------- | ------------------------------------------------------------------------------------------------------------- |
| **Own NPN** | The member sees records for their own NPN and directly assigned customers where applicable |
| **Managed NPNs** | The member sees records for the NPNs configured on their user account and direct assignments where applicable |
Filters are available for:
* Customers
* Calls
* Policies
* Attachments
After assigning a Managed NPN role, open the member's action menu and choose
**Configure Access** to select the NPNs they manage.
Removing a resource's View permission also removes its Data Filter because a
scope without feature access has no effect.
Policies and Calls reporting have their own explicit Self and Organization
permissions. NPN Data Filters do not narrow Organization reporting or expand Self
reporting. See [Reporting Access](#reporting-access).
Permission Dependencies [#permission-dependencies]
careCycle automatically adds prerequisites in several cases:
* Most Edit, Delete, Export, and Manage actions also enable View.
* Softphone Transfer also enables Use.
* Softphone Barge also enables Listen.
* Reporting: Self and Reporting: Organization also enable the resource's View.
* Reporting: Organization includes Self reporting access without requiring a
separate Self selection.
The selected count includes implied permissions.
Recommended Role Design [#recommended-role-design]
Start With The Job, Not The Person [#start-with-the-job-not-the-person]
Create roles such as:
* Licensed Agent
* Customer Service Representative
* Team Lead
* Call Supervisor
* Billing Administrator
Avoid one-off roles named after a specific person.
Grant The Smallest Useful Set [#grant-the-smallest-useful-set]
Start with the actions required for the job. Add permissions after a real need
is identified instead of enabling every feature in advance.
Separate Read From Operational Control [#separate-read-from-operational-control]
Examples:
* Wallboard View does not grant status overrides.
* Listen does not grant Barge.
* Appointment View does not grant Edit.
* Scripts View does not grant Submit or Edit.
Use Data Filters For Book Segmentation [#use-data-filters-for-book-segmentation]
Do not create a different feature role for every downline when the only
difference is record scope. Reuse the role and configure member-specific Managed
NPNs.
Review High-Risk Permissions [#review-high-risk-permissions]
Review these carefully:
* Delete Customers
* Delete Policies
* Export customer or call data
* View Customer Contact Info
* Listen or Barge into calls
* Status and routing overrides
* Developer Settings Edit
* Access Control Create, Update, or Delete
Changes And Propagation [#changes-and-propagation]
Permission changes normally appear quickly, but an already open browser may
take up to approximately one minute to refresh effective access. Refresh the
page if a role change does not appear immediately.
When a user's access is removed:
* Navigation updates after permissions refresh.
* Disabled controls prevent new actions.
* The server still rejects unauthorized requests immediately after its short
authorization cache refreshes.
FAQs [#faqs]
View grants record access. Add Reporting: Self or Reporting: Organization
under Policies or Calls to enable reporting. Management, Placement, and
Carriers require Policies Reporting: Organization. Inbound & Callbacks requires
Calls Reporting: Organization.
Default roles cannot be edited directly. Copy one into a custom role, choose
its reporting permissions, save it, and assign the custom role on Users or
select it when inviting a member.
They may have View without the matching action permission. Check Edit,
Submit, Manage, Assign, or the other specific operation.
Check the role's Data Filters and the NPNs configured on the member. Also
check whether the customer is directly assigned to the member.
Add the appropriate Status Override permission. Wallboard View is
intentionally read-only.
Call export and protected recording downloads require Calls Export.
Script design requires Scripts Edit. Saving the fields represented by the
script during a call requires Scripts Submit.
Wait briefly or refresh the application. If it persists, verify the member
is assigned to the intended role and active organization.
Related Guides [#related-guides]
Invite members and assign their roles.
Understand Available, Busy, On Call, and Wrap Up states.
Use live operations reporting and supervisor controls.
Understand the broader access-control and compliance posture.