Understand roles and permissions

Give each person the access they need without exposing settings to everyone. This article explains the difference between portal users and team members, the four role presets, and how to build custom roles.

Portal users and team members

Everyone in your Quackback workspace is either a portal user (a customer) or a team member with a role.

Team members can also use the public portal like any portal user. They don't need a separate account.

Role presets

Quackback ships four role presets, from broadest to narrowest access:

Workspace-level settings include general settings, branding, members and roles, sign-in and security, integrations, API keys, webhooks, the audit log, and support configuration such as SLA policies, office hours, routing, teams, and workflows, plus Quinn configuration and status page setup. Owners and Admins hold all of these. Managers hold none of them.

Contributors can, for example, view private posts, create posts, change a post's status, board, tags and owner, merge posts, approve posts, moderate and pin comments, view and reply to conversations, add internal notes, assign conversations, use Copilot, and view people, companies, segments, and analytics.

Warning: Every workspace needs at least one Owner. You can't remove or demote the last one.

Note: Upgrading from an earlier release maps the old roles onto the presets: admins become Owner and members become Manager, so nobody loses access. Review assignments afterwards and move people to narrower roles where it fits.

See exactly what each role can do

The Roles tab in Admin > Settings > Members & Teams shows the permission catalogue behind every role: roughly 90 individual permissions grouped by area, such as workspace settings, people, companies, feedback, conversations, changelog, help center, and integrations. Open a role there to see exactly which permissions it grants.

Permissions used by the API

A few API endpoints check a specific permission rather than a role, so custom roles work with them too:

An API key acts with the permissions of the team member who created it, limited to the scopes on the key. See API overview.

Custom roles

When no preset fits, create your own role from the Roles tab. A custom role can grant any mix of catalogue permissions, and you can assign it anywhere you can assign a preset: the member list, invites, and the REST API.

Create a custom role

1. Go to Admin > Settings > Members & Teams > Roles.
2. Click New role, or Duplicate on an existing role to start from its permissions.
3. Name the role and pick its permissions. Each category has a select-all, and you can filter permissions by key.
4. Save the role.

Rules that keep custom roles safe

• Built-in roles are read-only. Duplicate one to customize it. The presets themselves never change.
• You can only grant permissions you hold. Duplicating a richer role leaves the extra permissions off, and the editor tells you how many. The same ceiling applies when you assign a role to someone.
• You can't edit or delete a role you currently hold, so nobody can lock themselves out or quietly raise their own access.
• Deleting a role that is in use requires a destination. You choose the role its members move to, so nobody silently loses access.

Note: When a Quackback update adds new permissions, the built-in roles get them automatically, but custom roles do not. New permissions stay off until you turn them on. The role editor marks anything added since the role was last edited, so a quick review after an upgrade is all it takes.

A custom role counts as a regular team member for seats and access. On Quackback Cloud, every team member uses a seat, whatever their role.

Assign a custom role

• Existing member: in Members & Teams, click the ... menu on their row, choose Change role, and pick the role under Custom.
• New teammate: choose the role in the invite dialog. They hold it from the moment they accept.
• API: PATCH /api/v1/principals/:id with a roleId.

What portal users can do

Portal users interact with Quackback through your public portal and widget, never the admin dashboard. They sign in with the methods you allow, such as password, magic link, social sign-in, or a custom OIDC button.

Portal users can:

• Submit feedback and bug reports
• Vote on posts
• Comment on posts
• Edit and delete their own posts
• Browse your public roadmap and changelog

Tip: Portal users are unlimited and never use a seat. Encourage your whole user base to sign up and share feedback.

Change roles

1. Go to Admin > Settings > Members & Teams.
2. Find the member in the list.
3. Click the ... menu on their row and choose Change role.
4. Pick the new role.

Changes take effect immediately and don't affect the member's existing posts, comments, or activity history.

To turn a team member back into a portal user, remove them from the team. They keep their portal account and can still submit feedback.

Related articles

• Manage your team
• Configure team security
• Control portal access and sign-in
• How sign-in works
• Core concepts