Example roles and recipes
Complete setups you can copy. Each one starts from Duplicate on an existing role, because that is far faster and safer than ticking an empty grid.
Every recipe lists only what to change. Anything not mentioned stays as the role you duplicated had it.
Create one spare agent — test@yourcompany.com — and assign the new role to it. Sign in as that agent in a private browser window and click through what they are supposed to do.
Five minutes of that catches more than an hour of reading checkboxes, and it never risks your own access.
Front-line support agent
The most common role. Answers customers, keeps records tidy, touches no configuration.
Already built for you — the default Agent role is exactly this. Use it as-is.
If you want to tighten it slightly:
| Change | Why |
|---|---|
| Quick replies → drop to Read | The shared library is curated by supervisors; agents use it but do not add to it. |
| Customers → Create off | Customers arrive from conversations and Studio, so agents never need to add one by hand. |
| Achievements → Update off | Only a manager collects the account's achievement rewards. |
Shift supervisor
Runs a shift: sees everything, routes work, handles escalations. No billing, no agent management.
Duplicate: Team Leader
| Tab | Change |
|---|---|
| System | Leave as-is. Team Leader is already scoped for this. |
| Channels | Leave as-is — full access to every inbox. |
Optional narrowing:
| Change | Why |
|---|---|
| Settings → Business hours → Read only | Shift leaders read the schedule; the manager sets it. |
| Files warehouse → Delete off | Deleting account files is not a shift decision. |
| Delete a conversation off in Future inbox | Removes the ability to destroy an email thread. |
Floor monitor — watches, does not take
A senior agent who oversees the queue, routes work and steps in, but is not part of the rotation.
Duplicate: Agent
| Tab | Change |
|---|---|
| Channels → Future inbox | Untick Get Next in Line. Keep every see ability on. Keep Can assign conversations on. |
| System | Add Analytics → Read so they can see live volume. |
They see the whole queue, route it, and are never handed a conversation themselves.
Quality reviewer — comments, never replies
Reads conversations for coaching and compliance, annotates them, and the customer never hears from them.
Duplicate: Agent
| Tab | Change |
|---|---|
| Channels → Future inbox | Untick Send a new message, Start a new conversation, Resolve a conversation, Get Next in Line, Put a conversation on hold. Keep See All Open conversations, See all resolved conversations, See previous conversations, Send a private note, Set a label for a conversation. |
| System | Analytics → Read. Everything else off except Customers → Read. |
The two abilities that make this role work are Send a private note on (so they can leave coaching notes) and Send a new message off (so nothing reaches the customer).
Marketing and campaigns
Builds automations, forms and reports. Works its own conversations, not the support queues.
Already built for you — the default Marketing role.
Worth knowing: Marketing intentionally has none of the see abilities, so it works only from Mine — conversations assigned to it, or ones it started. If your marketing team also covers a shared inbox, tick that inbox's see abilities explicitly and leave Future inbox empty.
| Common addition | Why |
|---|---|
| My Ring → Update | If Marketing manages the live-chat widget's appearance. |
| Document signature → Create | If Marketing sends contracts or agreements. |
| On a specific inbox: See All Open conversations | If they share one campaign inbox with support. |
Channel-specific team
A team that works one channel and must not see the others — an outsourced WhatsApp team, a language-specific inbox, a regional line.
Duplicate: Agent
| Tab | Change |
|---|---|
| Channels → Future inbox | Clear all. This is the key step. |
| Channels → their inbox | Select all, then untick Delete a conversation. |
| System | Consider dropping Quick replies to Read and Files warehouse off. |
Because Future inbox is empty, any inbox you connect later is invisible to this role automatically — you never have to remember to restrict it.
An agent with My Ring → Read sees every inbox in the account listed on that page, including ones they cannot work in. For a role whose whole purpose is channel separation, leave My Ring off entirely.
External contractor or agency
Narrowest useful role. One channel, minimal data, nothing configurable.
Start from: + New role (an empty grid is right here — you want to grant deliberately, not remove)
| Tab | Setting |
|---|---|
| System | Customers → Read. Knowledge base → Read so they can look up answers. Nothing else. |
| Channels → Future inbox | Everything off. |
| Channels → their inbox | See the waiting line, Get Next in Line, Send a new message, Resolve a conversation, See previous conversations, Set a label for a conversation. |
Add Teams on top: put the contractor in one team and route only that team's work to them, so Get Next in Line hands them nothing outside their scope.
| Also do | Why |
|---|---|
| Enforce 2FA — Settings → Security & login | External access deserves a second factor. |
| Consider the IP allowlist | If they work from a fixed office. |
| Check Admin → Audit Log periodically | It records what was done and by whom. |
Accountant or bookkeeper
Needs invoices, plan and card details. Should never see a customer conversation.
Start from: + New role
| Tab | Setting |
|---|---|
| System | Billing → Credits → Read, Billing → Subscription → Read, Billing → Credit cards → Read, Billing → Usage pricing → Read. Nothing else. |
| Channels → Future inbox | Everything off. |
Add Billing → Credit cards → Create / Update / Delete only if they actually manage the company card. Leave Subscription → Update off unless they choose your plan — that changes what you pay.
This role has no Customers → Read, so the Customers page is gone too. The sidebar shows the Dashboard, Docs, Achievements if granted, and Billing. That is the point.
Read-only stakeholder
A manager, investor or consultant who wants numbers and no access to anything else.
Already built for you — the default Viewer role. Read almost everywhere, write nowhere, and no conversation access at all.
If they should also see conversation content — an auditor, for instance:
| Change | Why |
|---|---|
| Channels → Future inbox → tick See All Open conversations, See all resolved conversations, See previous conversations | They can read every conversation and change nothing, because Viewer has no send, resolve or assign abilities. |
That combination — every see ability on, every do ability off — is genuinely read-only across the whole inbox. It is worth knowing it is possible.
Trainee agent
Somebody learning the job whose replies should be checked before they touch customers.
Duplicate: Agent
| Tab | Change |
|---|---|
| Channels → Future inbox | Untick Send a new message. Keep Send a private note on. Untick Resolve a conversation, Delete a conversation and Can assign conversations. |
| System | Leave as-is. |
They can open the whole queue, draft their answer as a private note, and a supervisor sends it. When they are ready, tick Send a new message — or simply move them to the Agent role, which is usually the cleaner step.
AI operations
Somebody who tunes Studio flows and AI Agents but is not a support manager.
Duplicate: Marketing
| Tab | Change |
|---|---|
| System | Keep Studio → all four and AI World → Read + Update. Keep Knowledge base → all four. Add Agents → Read so they can see AI Agent profiles. Drop Forms and Views if not needed. |
| Channels → Future inbox | Tick See Studio Bot conversations and See AI Agent conversations — they need to watch what the automation is doing. |
Those two queues are the ones the default Agent role deliberately lacks, and the ones this role most needs.
An AI Agent is a row in the agents directory, so creating or editing one is Agents → Create / Update — the same permission as managing people. There is no separate AI-only permission today.
If that is too broad, keep AI profile changes with the Owner or Team Leader and give this role Agents → Read.
A structure that scales
If you are setting up an account from scratch, this is a sound starting point:
| Role | Who | Based on |
|---|---|---|
| Owner | You, plus one trusted second person | Fixed |
| Team Leader | Support manager | Default |
| Agent | Everyone on the front line | Default |
| Viewer | Stakeholders who want dashboards | Default |
| (add as needed) | Marketing, contractors, accountant | Recipes above |
Four roles cover most accounts. Add a fifth when a real person does not fit one of them — not in advance.
One Owner is a single point of failure: on holiday, off sick, left the company. Two means Teloring's last-Owner protection never blocks a legitimate change, and somebody can always reach billing and settings.
Signs your roles need a rethink
| Symptom | What it usually means |
|---|---|
| A role per person | You are modelling people, not jobs. Merge them. |
| Everybody is Owner | Nothing is protected. Move most people to Team Leader or Agent. |
| A role nobody holds | Delete it, or note in its description why it is being kept. |
| A role's permission count keeps climbing | It has been widened one exception at a time. Split it, or promote its holders to a broader role deliberately. |
| Agents keep asking for access | The role is too narrow for the actual job. Widen the role rather than moving people to a broader one. |
Related guides
- Roles and Permissions — creating, editing, assigning and deleting roles.
- System permissions reference — every feature and action.
- Channel permissions reference — the 18 inbox abilities.
- Agents and AI Agents — assigning a role to a person.
- Teams — routing, which pairs well with channel-specific roles.