Roles and permissions

Owner, Administrator, Support Manager, Agent, Viewer. Each role is a bundle of permission keys; keys are checked in the UI and again in the API on every request.

The catalogue spans 24 modules, including inbox, orders, broadcasts, automations, settings, and team. Per-action keys include inbox.reply and orders.refund.

Give an agent the inbox and customer keys; withhold billing, settings, and team management. An administrator can manage everything operational; only the owner touches billing.

This is blast-radius control, not distrust: when every sensitive action is a named key with an audit event behind it, you can grow the team without holding your breath.

Every permission mutation writes an append-only audit event. The audit page is the source of truth for who changed what, and no route exists to edit or delete those events.