Review security settings
Find the privacy and access controls that govern your support workspace.
On this page
Overview
Security is a Settings category containing Privacy and Roles. Use Privacy for retention controls and Roles for staff capabilities. Customer portal access is configured separately under System → Portal.
When to use this
Admins need one place to reason about who can see tickets and how long logs live. Splitting Privacy and Roles under Security matches the two-level catalog.
Where to find the controls
Settings Overview → Security cards, or #/settings/security/privacy and #/settings/security/roles. System Status for REST/permalink health.
Who can make these changes
manage_settings. Agents never need this category to reply.
Before you begin
Configure Roles first, then Privacy retention, then verify portal IDOR with two test customers. Keep page caches off /wp-json/elegant-support/.
Follow these steps
- Open Settings Overview.
- Enter Security.
- Set Roles.
- Set Privacy.
- Run a portal isolation test.
- Confirm public chat still rate-limits.
Settings reference
Child nav: Privacy, Roles. Related controls live on Channels (rate limit) and System (uninstall wipe).
Example workflow
An audit asks “who can export customers?” You open Roles and show export_customer on Manager and Admin only.
Good practices
Treat confirmed IDOR as P1. Documentation Center is not a substitute for role reviews.
Important considerations
Do not add users to Administrator “to make Settings work” if they only needed assign_ticket. That grants license and mailbox secrets.
If something does not work
Security nav empty: manage_settings missing. Portal leak: stop, see portal/overview, contact support. REST 401 after login: cookie/nonce, not Roles — see troubleshooting/overview.