# Roles and permissions

> Every role, every agent and manager permission with defaults, and the fixed rules about who sees what.

# Roles and permissions

## Roles

| Role | Scope | Summary |
| --- | --- | --- |
| **Owner** | Workspace | Everything. The only one who changes the AI key and sees owner-level deletions |
| **Admin** | Workspace or business | Everything else: settings, features, look, blocks, apps, team, activity, bots |
| **Manager** | Business | Agents' supervisor: analytics, client insights, agents' permissions, Live TV |
| **Agent** | Business | Answers clients, plus the permissions below |
| **Client** | Business | Guest, Verified, VIP or Spam |

## Permissions

Owners and admins always have all of them. Change them in **HQ → Settings → Agent permissions** or on a person's sheet in **HQ → Team**. A manager can give an agent only the permissions they hold themselves.

| Key | HQ label | Agent default | Manager default | Allows |
| --- | --- | --- | --- | --- |
| `flags` | See flags | On | On | Returning-client flags and "same person?" banners. Without it they show as a hidden message |
| `clientLogins` | Create client logins | Off | On | Give a guest a username and password |
| `clientPasswords` | Reset client passwords | On | On | Set a new client password (signs them out everywhere) |
| `deleteMessages` | Delete messages | Off | On | Delete anyone's message in a client's chat |
| `deleteClients` | Delete clients | Off | On | Remove a client and their whole chat |
| `block` | Block clients | Off | On | Block or unblock a client from writing |
| `tier` | Change client tiers | On | On | Guest, Verified, VIP, Spam; invite or approve Get verified |
| `coins` | Change client coins | On | On | Add or take coins (logged) |
| `clientInsights` | See Clients insights | Off | On | HQ → Clients and client insights in a chat |
| `payments` | See Payments | Off | **Never** | HQ → Payments |
| `photoReads` | See photo readings | Off | **Never** | AI readings under photos; mark money came or didn't |
| `gameCards` | Manage game cards | Off | On | Which game cards show in the group |
| `calls` | Make calls | On | On | Voice calls, when the feature is on |

## Fixed rules

These can't be changed by any setting:

- **Clients never see other clients' real names**: aliases everywhere in groups, games and boards.
- **Staff passwords** can only be reset by admins and owners.
- **Internal notes** can be written by any staff member in a client's chat. In groups and channels, only owners, admins and managers can write them.
- **Read receipts** (who read a message) are shown to owners, admins and managers in groups, channels, the Team chat and HQ. Never in DMs or client chats.
- **Pinning**: both people in a DM, admins in groups and channels, and any staff member in a support chat. Clients can't pin in groups.
- **Deletions** stay visible for 30 days to ranks above whoever deleted. See [The support inbox](https://docs.facia.chat/business/inbox#deleting-and-who-still-sees-it).
- **The AI bot** answers owners and admins only. Agents can't use it.
- **Counting rules** (how clients are counted) and **products** in Payments are admin-only.