## Overview

**Access governance (RBAC — Role-Based Access Control)** defines what each user can see and do. The
platform ships default roles (such as **Administrator** and **Agent**) and, when the **Custom Roles**
feature is enabled, you can build tailored roles with granular permissions and even restriction by
**inbox scope**.

With custom roles you can, for example, let someone manage contacts but not access reports, or let a
team see only the conversations from their own inboxes.

## Prerequisites

- The **Administrator** role to manage roles.
- **Custom Roles** is a **premium/optional** feature and may not be enabled on your account. If you
  only see the default roles (Administrator/Agent), the feature is not active — talk to the account
  owner or support.

## Step by step

1. In Settings, open the **roles** area (next to agents/teams).
2. To use the defaults, just assign **Administrator** or **Agent** when inviting or editing an agent.
3. To create a custom role, choose **new role**, give it a name and description.
4. Check the desired **permissions** (for example: manage contacts, view reports, manage
   conversations, administer settings).
5. Optionally, limit the role to **specific inboxes** (scope).
6. Save and assign the role to the matching agents.

## Settings & options

- **Administrator**: full access to the account and settings.
- **Agent**: focused on handling conversations, without broad admin access.
- **Granular permissions** (custom roles): toggle specific capabilities per product area.
- **Inbox scope**: restricts visibility to authorized inboxes.

## Use cases

- A **supervisor** who views reports and manages agents, but doesn't change integrations.
- A **sales agent** who accesses CRM and catalog, without seeing audit logs.
- An **outsourced team** restricted to a single inbox.

## Tips, limits & best practices

- Apply the **principle of least privilege**: grant only what's needed.
- Create **a few well-defined roles** rather than many nearly identical ones.
- Review roles when the org chart changes and when onboarding/offboarding people.
- Remember: custom roles are premium; without the feature, use the default roles.

## Troubleshooting

- **I can't see the custom roles option**: the premium feature is not enabled for the account.
- **An agent sees too much/too little**: review the permissions and inbox scope of the assigned role.
- **A permission change didn't show up**: ask the agent to reload the page or sign out and back in.

## See also

- [Account, agents and teams](/hc/ajuda/articles/administration-conta-agentes-equipes-en)
- [Audit logs](/hc/ajuda/articles/administration-auditoria-en)
- [Administration overview](/hc/ajuda/articles/administration-overview-en)
- [Integrations](/hc/ajuda/articles/administration-integracoes-en)