Defining User Roles

Required · Organize your support team

Give agents the permissions needed for their work while keeping account administration with the appropriate people. An agent role controls staff access. A customer role controls customer-facing access and is configured separately.

Before you begin

Use an administrator permitted to manage roles. Identify one administrator and one ordinary support-agent job. Have a test agent available to verify access. Keep a working administrator account while checking a narrower role.

Northstar’s support agents need to read and handle their assigned support work, add customer replies and internal notes, and hand work over. They do not automatically need account administration, bulk deletion or impersonation.

Review or create the role

1. Open Settings → Organization → Roles. Inspect an existing role that matches the job before selecting New Role.
2. Enter a recognizable Name and Description. For example, Northstar Support Agent describes a responsibility, not an individual person.
3. Review the role’s Permissions. Search for the actual operations the agent must perform, such as creating and closing cases, managing activities and transferring ownership. Read each permission label; do not enable an entire group because one action is needed.
4. If using Copy Role, choose Copy from, then Apply. Inspect the copied permissions and division scope before saving. Copying is a starting point, not an access review.
5. Review Divisions carefully. A proper subset narrows the configured division scope. An empty selection and all active divisions selected both mean unrestricted scope. “Select none” is not deny all. Selected root divisions also include their descendants.
6. Keep the role active when it is ready for use. Select Save Changes, reopen it and confirm the intended permissions and division selection.
7. Assign the role from the agent profile during Adding Your Agents.

Saved Agent role profile. Review an existing role before creating another.

Saved Agent role permissions. Each switch controls a specific staff capability.

Agent roles and division access contains the complete permission reference, including record-level and own-assigned-case behavior. Do not use the division selector as a substitute for testing actual access.

Verify as the intended agent

1. Have the test agent sign in again after the saved role assignment, then open a harmless case in the intended support division.
2. Confirm that the agent can read the case, prepare a reply, add an internal note and perform the authorized handoff or closure actions.
3. Check a case and configuration operation that should be excluded. Verify the actual result, not just whether a navigation item appears.
4. If the job requires access to several divisions, repeat for each intended scope. Keep the results with your onboarding checklist.

Meaningful choices

A single well-reviewed support role is often enough for a small team. Create a separate supervisor role only when its permissions differ. Do not make every agent an administrator just to remove a setup obstacle.

Customer knowledge restrictions belong to customer roles. Giving a contact a customer role does not create an agent login, and changing a staff role does not decide which public articles anonymous visitors can read.

If access is wrong

• An action is missing: identify that specific operation, review its permission and the record’s scope, save the smallest appropriate correction and retest.
• The agent sees too much: check whether the division selection is empty or includes all divisions, then inspect record-level/own-assigned exceptions described in the reference.
• A new role is absent from an agent picker: confirm it is active, then reopen the agent editor.
• Old permissions persist: have the agent save their work and sign out and back in. Do not repeatedly expand permissions to compensate for a stale session.

Completion check

• The staff role matches the job.
• Division scope has been interpreted correctly.
• Allowed and excluded actions were tested with an agent.
• Customer roles remain a separate access decision.
• Administrator recovery access is retained.

Previous: Divisions and Teams · Next: Adding Your First Queues