Skip to main content

Roles & permissions

Every person in an organization holds one of three roles. Roles are per organization: the same person can be an admin in one org and a member in another, and switches between them in the org switcher.

The three roles​

CapabilityOwnerAdminMember
Read tickets, conversations and knowledge✅✅✅
Reply to customers, work and resolve tickets✅✅✅
Manage knowledge sources (crawl, upload, connect)✅✅—
Change support configuration (channels, behavior, escalation, SLA)✅✅✅
Connect and approve MCP tools, configure action packs✅✅✅
Manage webhook triggers, review knowledge-base drafts✅✅✅
Create and revoke API keys✅✅—
Rotate the widget signing secret or a publishable key✅✅—
Approve or reject a parked action✅✅—
Take the workspace live (sandbox to production)✅✅—
Invite and remove teammates✅✅—
Change a teammate's role✅——
Transfer ownership✅——
Manage billing and change plan✅——

Configuring support is not an admin privilege. Connecting an MCP server or wiring up an integration is engineering work, and the person who owns the billing account is usually not the person doing it. Members can configure.

What members cannot do is the short list above: issue or rotate credentials, authorise a parked action, and take the workspace live. Those either grant access, approve something happening, or start billing. Adding somebody to your workspace is the decision that grants everything else.

Every organization has exactly one owner — the person who created it, or whoever ownership was last transferred to.

Rules the platform enforces​

  • You cannot change your own role. An admin cannot promote themselves; an owner cannot demote themselves.
  • You cannot assign the owner role. Ownership moves only through an explicit transfer, so an organization is never left with two owners or none.
  • Ownership can only transfer to an existing member. Invite the person first.

Seats​

Seats are unlimited on every plan, including Free. Adding teammates never changes your bill — only conversation volume does. See Subscription & Billing.

Not customer-settable​

Some values are deliberately outside role permissions, because setting them wrong would be unsafe or would remove a commercial guardrail:

  • Monthly conversation and AI-reply limits. These are derived from your plan. If an organization could set its own ceiling — especially to "unlimited" — it could drive unbounded model cost. Plan changes go through billing.
  • Platform-owned configuration on Lira-operated demo organizations.

Not supported yet​

  • No custom roles or granular permission sets. Three fixed roles only.
  • No SSO or SAML except on Enterprise. No SCIM provisioning — teammates are invited by email.