Who should see what? Roles and permissions for a small support team
Give each person the least access that lets them do their job: most people who answer customers need to read and reply, a few need to change settings and publish answers, and one or two need billing and the power to remove people. Write down who has which role, remove access the day someone leaves, and review the list every quarter. This guide maps six roles to real jobs in a small business and shows how they work in StayReplied.
Why roles matter even in a team of four
In a small business everyone does a bit of everything, so it is tempting to make everyone an admin. Then a trainee changes the widget settings by accident, someone publishes a draft price list, or a person who left months ago can still sign in. None of this needs bad intent. Roles exist so mistakes stay small.
Six roles, mapped to real jobs
StayReplied has six roles (owner, admin, supervisor, agent, read-only and billing only), each with explicit permissions, as the docs describe. The table below is a sensible way to map them to people; the exact permissions of each role are set in the product.
| Role | Typical person | Typical work |
|---|---|---|
| Owner | The business owner | Billing, plan, final say on everything |
| Admin | A trusted manager or the person who set the tool up | Settings, channels, team invitations |
| Supervisor | Shift lead, reception supervisor | Assigning, escalations, reviewing answers |
| Agent | Front desk, sales, support staff | Taking and answering conversations, notes |
| Read-only | Trainee in week one, a partner | Reading only |
| Billing only | An accountant | Plan and invoices, no conversations |
Two rules of thumb: there should be very few admins, and anyone who does not reply to customers should be read-only.
Who should publish answers and prices
Publishing is the most important permission after billing, because published knowledge and prices are what everyone answers from, and what the AI uses if you turn it on. In StayReplied, documents and price records go through draft, review and publish; every document version is kept with the option to roll back, and a price is changed by approving it again or retired. Let agents suggest changes, and keep publishing with the person who owns the facts: the supervisor for hours and policies, the owner for prices (why one approved price list matters).
Starting and leaving
When someone joins
- Invite them with their own e-mail; never share one login.
- Start at the lowest role that fits their first week, often read-only.
- Move them up once they have been trained (a one-hour training plan).
Invitations expire and can be revoked, so an invitation sent to the wrong address is easy to cancel.
When someone leaves
- Remove their access on their last day, not "later".
- Reassign their open conversations with a note.
- Check that nothing important lived only with them, such as a promise in a personal phone.
Because conversations live in the shared workspace, the history stays when the person goes. That is one of the main reasons teams move off personal phones.
Seats and plans
Every person who signs in uses a seat, and seats include the owner. On the pricing page, Starter has 2 seats, Team 5 and Business 10; every plan has every feature, so roles work the same on each. The 14-day free trial has 2 seats.
What the security side looks like
On the security page, StayReplied describes least privilege as roles with explicit permissions, and notes that a workspace admin is not a platform-wide reader. Sign-in supports an authenticator app for a second step, and exports, configuration changes, knowledge publication, sends, consent and overrides are recorded in an audit trail. Turn on the authenticator step for the owner and admins at least. Roles limit who sees what; what customers should never send you in a chat limits what there is to see.
A quarterly access check
Fifteen minutes, every three months:
- List everyone with access and their role.
- Anyone who left? Remove them.
- Anyone with more access than their job needs? Lower it.
- More than two admins? Ask why.
- Owner and admins using an authenticator app for sign-in?
- Who can publish prices? Is that still right?
How roles help the daily work
Roles also keep the unified inbox calm. A supervisor sees escalated conversations and reassigns; agents work from unassigned and mine; read-only members can read a conversation for context without any risk of replying by accident. Fewer people with the power to change things means fewer surprises.
When this is not for you
If you are one person answering every customer, roles do not matter yet; set yourself up as owner and come back to this when you hire. If you need a detailed custom permission for each individual action, check the role permissions in the product before you commit. And who StayReplied is for describes the team sizes it fits today.
Questions and answers
What roles does a small customer-service team need?
Usually an owner, one or two admins, a supervisor per shift, agents who answer, read-only access for people who only read, and billing only for whoever pays the invoices. StayReplied has these six roles.
Should everyone on the team be an admin?
No. Keep admins to one or two people, and give everyone else the lowest role that lets them do their work.
What should I do when a staff member leaves?
Remove their access on their last day, reassign their open conversations with a note, and check that no promises lived only on their phone.
Does StayReplied support two-step sign-in?
Yes. Sign-in supports an authenticator app as a second step, as the security page describes.
Set up your team with the right access from day one.
start your free trial, 14 days, no card needed.