# Roles and permissions

> What owners, admins, agents and viewers can do in ShopAssist, and how store-restricted memberships work.

Source: https://shopassist.coec.dk/docs/team/roles-and-permissions · Updated 2026-10-01

Every member of an organization has one role. A role applies to all stores of the organization, or only to some stores if the membership is [store-restricted](#store-restricted).

| Role       | For                                                             |
| ---------- | --------------------------------------------------------------- |
| **Owner**  | billing, deleting the organization, managing other owners       |
| **Admin**  | setting up stores, integrations, API keys, webhooks and members |
| **Agent**  | answering shoppers in the inbox and using the playground        |
| **Viewer** | reading conversations and analytics                             |

## Permission table [#permissions]

| Permission                                                          | Owner | Admin | Agent | Viewer |
| ------------------------------------------------------------------- | ----- | ----- | ----- | ------ |
| View the organization, members, stores and settings                 | ✓     | ✓     | ✓     | ✓      |
| Edit organization details, grant support access, view the audit log | ✓     | ✓     | —     | —      |
| Accept legal terms (DPA)                                            | ✓     | —     | —     | —      |
| Delete the organization, transfer ownership                         | ✓     | —     | —     | —      |
| Invite and manage members (not owners)                              | ✓     | ✓     | —     | —      |
| Promote or demote owners                                            | ✓     | —     | —     | —      |
| Create stores                                                       | ✓     | ✓     | —     | —      |
| Configure stores, catalog, knowledge, AI and the widget             | ✓     | ✓     | —     | —      |
| Connect and disconnect stores, rotate keys and secrets              | ✓     | ✓     | —     | —      |
| Run syncs                                                           | ✓     | ✓     | —     | —      |
| Manage handoff integrations                                         | ✓     | ✓     | —     | —      |
| Read conversations                                                  | ✓     | ✓     | ✓     | ✓      |
| Search message text                                                 | ✓     | ✓     | ✓     | —      |
| See shopper names and emails in conversation details                | ✓     | ✓     | ✓     | —      |
| See shopper emails in lists (conversations, leads)                  | ✓     | ✓     | —     | —      |
| Take over, reply, add notes, assign to self, close                  | ✓     | ✓     | ✓     | —      |
| Assign conversations to others                                      | ✓     | ✓     | —     | —      |
| Delete conversations                                                | ✓     | ✓     | —     | —      |
| Use the playground                                                  | ✓     | ✓     | ✓     | —      |
| Simulate a signed-in customer in the playground                     | ✓     | ✓     | —     | —      |
| Handle privacy requests                                             | ✓     | ✓     | —     | —      |
| Read leads (masked)                                                 | ✓     | ✓     | ✓     | ✓      |
| Lead details with consent evidence, delete, export                  | ✓     | ✓     | —     | —      |
| Read analytics                                                      | ✓     | ✓     | ✓     | ✓      |
| Export analytics                                                    | ✓     | ✓     | —     | —      |
| API keys and webhooks                                               | ✓     | ✓     | —     | —      |
| View billing                                                        | ✓     | ✓     | —     | —      |
| Change plans, payment methods, overage budget                       | ✓     | —     | —     | —      |
| Export all organization data                                        | ✓     | —     | —     | —      |

Masked values look like `j***@example.dk` and `J. B.`.

## Store-restricted memberships [#store-restricted]

When you invite someone, you can limit the membership to some stores. A store-restricted member:

* sees only those stores and the members who share at least one of them;
* never gets organization-level permissions, whatever the role: a restricted admin cannot manage billing, members, API keys or webhooks.

Deleting a store removes it from every restricted membership; a membership left with no stores is removed.

## Rules [#rules]

* An organization always has at least one owner. Admins cannot change owners, and nobody can change their own role.
* Role and store changes take effect within a minute, including for open dashboards.
* Sensitive actions (API keys, webhooks, destination changes, exports) ask you to sign in again if your last sign-in is older than a few minutes.