Canonical page: https://docs.teloring.com/docs/product/roles/examples Last modified: 2026-08-20T20:49:57.000Z # Example roles and recipes Complete setups you can copy. Each one starts from **Duplicate** on an existing role, because that is far faster and safer than ticking an empty grid. Every recipe lists only what to **change**. Anything not mentioned stays as the role you duplicated had it. :::tip Test a role before you hand it out Create one spare agent — *test@yourcompany.com* — and assign the new role to it. Sign in as that agent in a private browser window and click through what they are supposed to do. Five minutes of that catches more than an hour of reading checkboxes, and it never risks your own access. ::: --- ## Front-line support agent The most common role. Answers customers, keeps records tidy, touches no configuration. **Already built for you** — the default **Agent** role is exactly this. Use it as-is. If you want to tighten it slightly: | Change | Why | | --- | --- | | **Quick replies** → drop to **Read** | The shared library is curated by supervisors; agents use it but do not add to it. | | **Customers → Create** off | Customers arrive from conversations and Studio, so agents never need to add one by hand. | | **Achievements → Update** off | Only a manager collects the account's achievement rewards. | --- ## Shift supervisor Runs a shift: sees everything, routes work, handles escalations. No billing, no agent management. **Duplicate:** Team Leader | Tab | Change | | --- | --- | | System | Leave as-is. Team Leader is already scoped for this. | | Channels | Leave as-is — full access to every inbox. | **Optional narrowing:** | Change | Why | | --- | --- | | **Settings → Business hours** → **Read** only | Shift leaders read the schedule; the manager sets it. | | **Files warehouse → Delete** off | Deleting account files is not a shift decision. | | **Delete a conversation** off in Future inbox | Removes the ability to destroy an email thread. | --- ## Floor monitor — watches, does not take A senior agent who oversees the queue, routes work and steps in, but is not part of the rotation. **Duplicate:** Agent | Tab | Change | | --- | --- | | Channels → **Future inbox** | Untick **Get Next in Line**. Keep every *see* ability on. Keep **Can assign conversations** on. | | System | Add **Analytics → Read** so they can see live volume. | They see the whole queue, route it, and are never handed a conversation themselves. --- ## Quality reviewer — comments, never replies Reads conversations for coaching and compliance, annotates them, and the customer never hears from them. **Duplicate:** Agent | Tab | Change | | --- | --- | | Channels → **Future inbox** | Untick **Send a new message**, **Start a new conversation**, **Resolve a conversation**, **Get Next in Line**, **Put a conversation on hold**. Keep **See All Open conversations**, **See all resolved conversations**, **See previous conversations**, **Send a private note**, **Set a label for a conversation**. | | System | **Analytics → Read**. Everything else off except **Customers → Read**. | The two abilities that make this role work are **Send a private note** on (so they can leave coaching notes) and **Send a new message** off (so nothing reaches the customer). --- ## Marketing and campaigns Builds automations, forms and reports. Works its own conversations, not the support queues. **Already built for you** — the default **Marketing** role. Worth knowing: Marketing intentionally has **none** of the *see* abilities, so it works only from *Mine* — conversations assigned to it, or ones it started. If your marketing team also covers a shared inbox, tick that inbox's *see* abilities explicitly and leave **Future inbox** empty. | Common addition | Why | | --- | --- | | **My Ring → Update** | If Marketing manages the live-chat widget's appearance. | | **Document signature → Create** | If Marketing sends contracts or agreements. | | On a specific inbox: **See All Open conversations** | If they share one campaign inbox with support. | --- ## Channel-specific team A team that works one channel and must not see the others — an outsourced WhatsApp team, a language-specific inbox, a regional line. **Duplicate:** Agent | Tab | Change | | --- | --- | | Channels → **Future inbox** | **Clear all**. This is the key step. | | Channels → their inbox | **Select all**, then untick **Delete a conversation**. | | System | Consider dropping **Quick replies** to **Read** and **Files warehouse** off. | Because **Future inbox** is empty, **any inbox you connect later is invisible to this role automatically** — you never have to remember to restrict it. :::warning Do not grant My Ring → Read here An agent with **My Ring → Read** sees every inbox in the account listed on that page, including ones they cannot work in. For a role whose whole purpose is channel separation, leave My Ring off entirely. ::: --- ## External contractor or agency Narrowest useful role. One channel, minimal data, nothing configurable. **Start from:** **+ New role** (an empty grid is right here — you want to grant deliberately, not remove) | Tab | Setting | | --- | --- | | System | **Customers → Read**. **Knowledge base → Read** so they can look up answers. Nothing else. | | Channels → **Future inbox** | Everything off. | | Channels → their inbox | **See the waiting line**, **Get Next in Line**, **Send a new message**, **Resolve a conversation**, **See previous conversations**, **Set a label for a conversation**. | Add [Teams](../teams.md) on top: put the contractor in one team and route only that team's work to them, so **Get Next in Line** hands them nothing outside their scope. | Also do | Why | | --- | --- | | Enforce 2FA — **Settings → Security & login** | External access deserves a second factor. | | Consider the IP allowlist | If they work from a fixed office. | | Check **Admin → Audit Log** periodically | It records what was done and by whom. | --- ## Accountant or bookkeeper Needs invoices, plan and card details. Should never see a customer conversation. **Start from:** **+ New role** | Tab | Setting | | --- | --- | | System | **Billing → Credits → Read**, **Billing → Subscription → Read**, **Billing → Credit cards → Read**, **Billing → Usage pricing → Read**. Nothing else. | | Channels → **Future inbox** | Everything off. | Add **Billing → Credit cards → Create / Update / Delete** only if they actually manage the company card. Leave **Subscription → Update** off unless they choose your plan — that changes what you pay. :::note They will see very little else This role has no **Customers → Read**, so the Customers page is gone too. The sidebar shows the Dashboard, Docs, Achievements if granted, and Billing. That is the point. ::: --- ## Read-only stakeholder A manager, investor or consultant who wants numbers and no access to anything else. **Already built for you** — the default **Viewer** role. Read almost everywhere, write nowhere, and no conversation access at all. If they should also see conversation *content* — an auditor, for instance: | Change | Why | | --- | --- | | Channels → **Future inbox** → tick **See All Open conversations**, **See all resolved conversations**, **See previous conversations** | They can read every conversation and change nothing, because Viewer has no send, resolve or assign abilities. | That combination — every *see* ability on, every *do* ability off — is genuinely read-only across the whole inbox. It is worth knowing it is possible. --- ## Trainee agent Somebody learning the job whose replies should be checked before they touch customers. **Duplicate:** Agent | Tab | Change | | --- | --- | | Channels → **Future inbox** | Untick **Send a new message**. Keep **Send a private note** on. Untick **Resolve a conversation**, **Delete a conversation** and **Can assign conversations**. | | System | Leave as-is. | They can open the whole queue, draft their answer as a **private note**, and a supervisor sends it. When they are ready, tick **Send a new message** — or simply move them to the **Agent** role, which is usually the cleaner step. --- ## AI operations Somebody who tunes Studio flows and AI Agents but is not a support manager. **Duplicate:** Marketing | Tab | Change | | --- | --- | | System | Keep **Studio → all four** and **AI World → Read + Update**. Keep **Knowledge base → all four**. Add **Agents → Read** so they can see AI Agent profiles. Drop **Forms** and **Views** if not needed. | | Channels → **Future inbox** | Tick **See Studio Bot conversations** and **See AI Agent conversations** — they need to watch what the automation is doing. | Those two queues are the ones the default **Agent** role deliberately lacks, and the ones this role most needs. :::note Editing an AI Agent profile needs Agents → Update An AI Agent is a row in the agents directory, so creating or editing one is **Agents → Create / Update** — the same permission as managing people. There is no separate AI-only permission today. If that is too broad, keep AI profile changes with the Owner or Team Leader and give this role **Agents → Read**. ::: --- ## A structure that scales If you are setting up an account from scratch, this is a sound starting point: | Role | Who | Based on | | --- | --- | --- | | **Owner** | You, plus one trusted second person | Fixed | | **Team Leader** | Support manager | Default | | **Agent** | Everyone on the front line | Default | | **Viewer** | Stakeholders who want dashboards | Default | | *(add as needed)* | Marketing, contractors, accountant | Recipes above | Four roles cover most accounts. Add a fifth when a real person does not fit one of them — not in advance. :::tip Two Owners, always One Owner is a single point of failure: on holiday, off sick, left the company. Two means Teloring's last-Owner protection never blocks a legitimate change, and somebody can always reach billing and settings. ::: ### Signs your roles need a rethink | Symptom | What it usually means | | --- | --- | | A role per person | You are modelling people, not jobs. Merge them. | | Everybody is Owner | Nothing is protected. Move most people to Team Leader or Agent. | | A role nobody holds | Delete it, or note in its description why it is being kept. | | A role's permission count keeps climbing | It has been widened one exception at a time. Split it, or promote its holders to a broader role deliberately. | | Agents keep asking for access | The role is too narrow for the actual job. Widen the role rather than moving people to a broader one. | --- ## Related guides - [Roles and Permissions](./overview.md) — creating, editing, assigning and deleting roles. - [System permissions reference](./system-permissions.md) — every feature and action. - [Channel permissions reference](./channel-permissions.md) — the 18 inbox abilities. - [Agents and AI Agents](../agents.md) — assigning a role to a person. - [Teams](../teams.md) — routing, which pairs well with channel-specific roles.