Manage agent roles and permissions
Assign support roles and permissions that match each team member’s responsibilities.
On this page
Overview
Roles live at Settings → Security → Roles (#/settings/security/roles). Shipped roles: es_support_admin (Support Admin, all caps), es_support_manager, es_support_agent, es_support_viewer. Capabilities are elegant_support_view_ticket, create_ticket, reply_ticket, assign_ticket, delete_ticket, view_customer, manage_customer, delete_customer, merge_customer, export_customer, anonymize_customer, manage_kb, view_kb, manage_automation, view_reports, manage_sla, manage_settings, manage_agents, use_ai, manage_ai, view_commerce, manage_integrations, view_integration_logs. WordPress Administrator keeps all caps. Reset roles restores the shipped map.
When to use this
A Viewer must not reply or open Settings. Granular caps keep a contractor out of license keys and AI providers.
Where to find the controls
#/settings/security/roles. Users are assigned roles in WordPress Users. Security category also contains Privacy.
Who can make these changes
Support Admins and WP admins edit the matrix. Do not give manage_settings to every agent.
Before you begin
Tick caps per role, save, then have that user reload the SPA. Reset roles if the matrix was experimented to a dead end.
Follow these steps
- Open Roles.
- Compare Manager vs Agent (Manager has automation, SLA, KB manage, delete/merge/export customer).
- Grant use_ai only to people who may send ticket text to a BYOK provider.
- Assign the WordPress role to the user.
- Verify forbidden screens.
Settings reference
Role key, label, checkbox per elegant_support_* cap, Reset roles to defaults.
Example workflow
A seasonal hire gets Support Agent: they can reply and assign but cannot open #/settings or #/automation.
Good practices
Prefer shipped roles over a dozen custom mixes. Viewers are useful for team leads who only watch Reports.
Important considerations
manage_settings includes license, IMAP passwords, and Feature Manager. Reset roles does not remove Administrator caps.
If something does not work
REST 403 on a screen: missing cap, not a JS bug. User has two roles — WP merges caps. Contact support if Reset roles fails or Administrator lost helpdesk access after a reset.