Skip to main content
Xobito lets you bring in as many teammates as your plan allows. Every teammate has exactly one role, and that role decides what they can see and do.
The person who first creates a Xobito workspace is the workspace owner. Owners bypass the role system entirely — they have full access to every feature. Everyone else is subject to the role they’ve been assigned.

​
The three building blocks

Staff Members

Invite new users, edit existing ones, remove people who’ve left.

Roles & Permissions

Build custom roles by ticking permissions from the 76-item list.

Activity Log

See who did what — contact edits, campaign sends, template submissions, and more.

​
How they fit together

1

You create roles

A role is a named bundle of permissions. Start with the default Agent role or create your own.
2

You invite staff

When you invite someone, you pick which role they have. They’ll only be able to use the features that role allows.
3

Xobito records their actions

Every time a staff member does something meaningful — creating a contact, sending a campaign, editing a bot — an entry lands in the Activity Log.

​
The default role

When a workspace is first provisioned, exactly one role is created automatically:
RoleDefault permissions
Agenttenant.chat.view only
That’s it. The Agent role exists so that new staff can at least open the chat inbox the moment they’re invited. Anything else — contacts, campaigns, templates, settings — the owner needs to either extend the Agent role or create additional roles like “Manager” or “Admin”.
There is no pre-seeded “Admin” role. The workspace owner is implicitly an admin through their account flag (is_admin); they don’t use the role system. To give another teammate admin-like access, create a role, tick every permission you want, and assign them to it.

​
Who can manage the team?

To invite, edit, or remove staff, a user needs:
  • tenant.staff.view — to see the staff list.
  • tenant.staff.create — to invite new members.
  • tenant.staff.edit — to change someone’s role or details.
  • tenant.staff.delete — to remove a staff member.
To manage roles themselves:
  • tenant.role.view
  • tenant.role.create
  • tenant.role.edit
  • tenant.role.delete
The workspace owner has all of these automatically.

​
Workspace owner bypass

Any user with the is_admin flag — normally just the workspace owner — bypasses every permission check. They can do anything the workspace is capable of, regardless of what role they hold. Keep the number of admins small.

​
What’s next

Invite your first teammate

Send an invite and pick a role.

Build a custom role

The full permission reference.

See who's doing what

Audit trail of workspace actions.