Roles in a shared inbox: who should see the whole history
Four roles cover most businesses: owner, admin, agent, restricted agent. The two permissions that need separating from everything else are export and changing where messages go.
The four roles
| Role | Can | Cannot |
|---|---|---|
| Owner | Everything, including billing and deleting the account | - |
| Admin | Manage people, numbers, automations | Billing |
| Agent | Read and answer everything | Change routing, export, manage people |
| Restricted agent | Read and answer their assigned numbers | See other numbers at all |
The two dangerous permissions
Export
An export is the moment your access control stops mattering: the data is now a file on somebody's laptop. Restrict it to admins, record every one in the audit log, and make the record say what was exported rather than just that something was.
Changing the webhook or routing
Whoever can change where messages are delivered can quietly redirect your inbound traffic. It looks like a settings field and it is a data exfiltration path, which is why it belongs with admins and not with everybody who can answer a message.
The restricted agent role is the one that gets built late and needed early - a branch that should only see its own number, an outsourced team on one product line, a temp during a peak. Retro-fitting per-number scoping to a system that assumed everyone sees everything is a large change, and search is where it usually leaks.
Removing access is the part that fails
- Have a leaver routine, and put messaging on it. It is rarely on the list beside email and payroll.
- Check what breaks when you remove them. If a token was issued from their account, messaging stops - see Page tokens.
- Review the list quarterly. Every shared inbox accumulates people who left, contractors who finished, and one account nobody recognises.
Operator access, if you are the vendor
Support staff who can open a customer's account need a different code path, a visible banner saying whose account they are in, and an audit entry every time. Invisible operator access is indistinguishable from a breach, including to you.
Questions people actually ask
Should every agent see every conversation?
In a small team, usually yes - the alternative costs more than it protects. It stops being reasonable when you have staff who should only see one branch, one number, or one language.
Who should be able to export conversations?
Very few people, and every export should be recorded. An export is the point at which your access controls stop applying to the data.
Njiwa
One inbox for WhatsApp, Facebook and Instagram, and an API that sends over either WhatsApp rail. 7 days free, no card.