SilentChat

Teams & roles

Every person in the tenant has exactly one role. Roles bundle permissions and decide what someone can see, edit, or delete. Departments and agent presence layer on top for day-to-day work.

System roles

SilentChat ships with seven system roles that cover most teams. They can't be deleted, and their permissions are fixed.

  • Tenant Owner — Full access including billing, account deletion, and ownership transfer. Exactly one per tenant.
  • Tenant Admin — Full access to every functional area except ownership transfer.
  • Manager — Reads everything; writes conversations, contacts, team, and canned responses. No billing access.
  • Agent — Handles conversations and contacts. No settings, no analytics, no team management.
  • Billing Admin — Sees and edits billing only — plans, invoices, payment methods.
  • Developer — Full access to widgets, domains, API keys, and webhooks. No conversation access.
  • Analyst — Read-only across conversations, contacts, and analytics. Cannot write.

Tenant admins can spin up custom roles with bespoke permission sets — granular per resource (Read/Write/Delete).

Permission granularity

Permissions are set per resource (Conversations, Contacts, Widgets, Webhooks, Billing, …) and per action (Read/Write/Delete). The backend checks them on every endpoint — the frontend only hides UI.

  • The frontend only renders actions that the user has permission for.
  • The backend rejects unauthorized requests with 403 + ERR_RBAC_PERMISSION_DENIED.
  • Permission changes take effect immediately — no re-login required, since JWT claims are revalidated server-side.

Departments

Departments group agents by domain (Support, Sales, Onboarding). They're independent of role — an agent can belong to multiple departments.

  • Workflow routing: conversations can be auto-assigned to a department.
  • Reporting: analytics filter by department for workload, SLA adherence, and CSAT.
  • Tickets: every ticket can optionally be assigned to a department.

Agent presence

Status tells other agents and the auto-router who's currently available. Switch manually from the profile menu, or automatically after inactivity.

  • Online — Actively logged in and eligible for auto-routing. The tab doesn't have to be in the foreground.
  • Away — Manually set or after 10 minutes of inactivity. Auto-routing skips this agent.
  • Offline — Logged out or explicitly offline. Conversations route to other agents.

Invite flow

New team members are invited by email. Owner and admin roles can invite, subject to plan limits.

  • Settings → Team → "Invite member" — enter email, pick a role, optionally a department.
  • We send a signed invite email with a 7-day TTL.
  • The recipient sets a password (or signs in via SSO) and is automatically attached to the tenant.
  • Pending invites can be revoked or re-sent before they expire.

Lite seats are read-only seats for stakeholders who should follow along but not reply — they don't consume a full plan slot.

Teams & roles | SilentChat