> For the complete documentation index, see [llms.txt](https://help.gleantap.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.gleantap.com/settings/add-remove-sub-users/roles-and-permissions-reference.md). # Roles & Permissions Reference This page details every permission Gleantap grants — what each predefined role can do, and how to build a custom role when the built-in ones don't fit. For adding, removing, or editing sub-users, see Add / Remove Sub Users. *** ## Predefined roles Gleantap ships with five predefined roles. You can assign these directly when creating or editing a sub-user. ### Admin **Full access to everything on the account** — every workroom, every setting, every feature. Admins can invite other sub-users, change roles, configure integrations, and manage billing. Use for account owners and senior operators. ### Workroom Admin **Full access to their assigned workrooms**, but not to workrooms they haven't been granted access to. Otherwise identical to Admin within scope. Use for location managers in multi-workroom accounts (see Managing Multiple Locations). ### Marketing Access to: * **Marketing modules** — Campaigns (Email/SMS/Keyword), Flows, Templates, Forms & Pages, Segments, Reputation, Reports * **General** — Contacts, Inbox, Tasks, Appointments * **Scorecards** — view and configure **No access to:** Sales Pipeline configuration, most Settings, Integrations. Use for marketing managers running campaigns and flows. ### Sales Access to: * **Sales modules** — Pipeline, Appointments, Tasks * **General** — Contacts, Inbox * **Scorecards** — view **No access to:** Campaigns, Flows, Templates, most Settings. Use for sales reps and pipeline managers. ### Analyst **Read-only access** to General, Scorecards, and the Marketing section. Analysts can view campaigns, reports, segments, and dashboards — but cannot edit, create, or send anything. Use for stakeholders who need visibility but shouldn't be able to make changes (e.g., business owners auditing performance, consultants). *** ## Custom roles If none of the predefined roles fits your team, you can create a custom role that grants exactly the permissions you want. ### Creating a custom role 1. Go to **Settings → Sub Users**. 2. Look for **Custom Roles** in the settings area (may appear as a tab or a link near the Sub Users list). 3. Click **Add Custom Role**. 4. Enter a role name (e.g., "Campaign Approver", "Read-only Sales", "Front Desk"). 5. Toggle the permissions you want to grant. See the [Permission matrix](#permission-matrix) below. 6. Save. The custom role now appears in the role dropdown when you add or edit a sub-user. ### Editing or deleting a custom role * **Editing** — the role changes take effect immediately for every user assigned that role. * **Deleting** — you can only delete a custom role if no sub-users are currently assigned to it. Reassign users to a different role first. *** ## Permission matrix Each module has up to four action permissions: * **View** — see the module and its content * **Add** — create new items * **Edit** — modify existing items * **Delete** — remove items Some modules also support **level modifiers**: * **Own** — only items the user created * **All** — every item in the workroom This lets you build roles like "can edit only campaigns they created themselves" (View: All, Edit: Own). ### Modules with permission controls | Module | Actions | Level modifiers | | --------------------------------- | ----------------------- | --------------- | | **Tasks** | View, Add, Edit, Delete | Own / All | | **Contacts (Audience)** | View, Add, Edit, Delete | Own / All | | **Segments** | View, Add, Edit, Delete | Own / All | | **Campaigns — Email** | View, Add, Edit, Delete | Own / All | | **Campaigns — SMS** | View, Add, Edit, Delete | Own / All | | **Campaigns — Keyword** | View, Add, Edit, Delete | — | | **Templates** | View, Add, Edit, Delete | Own / All | | **Flows** | View, Add, Edit, Delete | Own / All | | **Forms** | View, Add, Edit, Delete | — | | **Checkout Forms** | View, Add, Edit, Delete | — | | **Pages** | View, Add, Edit, Delete | — | | **Appointments** | View, Add, Edit, Delete | Own / All | | **Sales Pipeline** | View, Add, Edit, Delete | Own / All | | **Configure Workroom (Settings)** | View, Edit | — | | **Configure Email** | View, Edit | — | | **Configure AI / Chatbot** | View, Edit | — | | **Configure SMS** | View, Edit | — | | **Configure Notifications** | View, Edit | — | | **Sub Users** | View, Add, Edit, Delete | — | | **Custom Metrics** | View, Add, Edit, Delete | — | | **API Access** | View, Edit | — | | **Custom Domains** | View, Edit | — | | **Integrations** | View, Edit | — | ### Recipes: common custom roles **"Junior campaign writer"** — Can build campaigns but everything requires approval before sending: * Campaigns Email: View All, Add, Edit Own * Campaigns SMS: View All, Add, Edit Own * Templates: View All, Add, Edit Own * Segments: View All * Contacts: View All * Combined with **Require Approval on Campaigns & Flows** on their sub-user profile **"Front desk / concierge"** — Handle inbox conversations and appointments, no campaign access: * Contacts: View All, Add, Edit Own * Appointments: View All, Add, Edit Own * Tasks: View All, Add, Edit Own * No Campaign, Flow, Template, or Settings access **"Reports viewer for owner"** — Read-only across the board: * Every module: View All * No Add/Edit/Delete permissions anywhere *** ## How role changes take effect Role and permission changes take effect **immediately on save**. The sub-user doesn't need to log out and back in. On their next click, the app re-checks their permissions against the updated role. *** ## Roles do not scope by location **Important:** roles control which *features* a user has access to, not which *locations* (contacts, segments, pipeline items) they can see. If a user has "View Contacts" permission, they see every contact in every workroom they're a member of — regardless of location. If you need per-location isolation, use one workroom per location (Pattern A in Managing Multiple Locations) and grant workroom access selectively. *** ## Related pages * Add / Remove Sub Users — day-to-day management * Campaign Approval — approval-workflow guardrail * Managing Multiple Locations — how workrooms scope access --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.gleantap.com/settings/add-remove-sub-users/roles-and-permissions-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.