Skip to main content
A role in Xobito is a named bundle of permissions. Every staff member has one role. There is no built-in hierarchy — two roles can’t “inherit” from each other. You build each role independently by ticking the permissions it should include.
The workspace owner (the user with the is_admin flag) bypasses the role system entirely — they have every permission, always. Roles only matter for other staff.

​
How roles work

1

Create a role

Name it, tick the permissions, save.
2

Assign staff to it

Open a staff member’s profile and pick the role.
3

Edit it any time

Ticking or unticking a permission applies immediately to everyone with that role.

​
The default role

Workspaces ship with exactly one auto-created role: That’s the minimum — an Agent can open the Live Chat inbox. Anything else needs to be added by ticking more permissions, or by creating additional roles.
There is no pre-seeded “Admin” role. To give someone admin-like access, create a role and tick every permission. Don’t use the is_admin flag on regular staff — that flag is reserved for the workspace owner.

​
Create a role

Go to Team → Roles and click Create Role.
1

Name it

For example “Sales Manager” or “Read-only Auditor”.
2

Tick permissions

Tick each permission you want this role to have. The full list is below.
3

Save

The role is immediately available when inviting or editing staff.

​
Edit or delete a role

  • Edit — ticking or unticking any permission applies immediately to every staff member with the role.
  • Delete — only possible if no staff member currently has that role. Reassign those staff first.
Revoking a permission takes effect on the affected user’s next page load. If they’re mid-task when you change the role, that specific action may fail partway through. Communicate major changes.

​
Super-admin bypass

Xobito has one special behaviour to keep in mind. Any user with the is_admin flag on their account (by default, just the workspace owner) passes every permission check, no matter which role they hold.
  • You do not need to build an “Everything” role for the workspace owner — they already have access.
  • Do not set is_admin on regular staff. It’s the equivalent of giving them root access.

​
Permission reference

There are 77 tenant-scoped permissions in total, grouped by resource. Tick the ones a role should have.
Permission names use the format tenant.{resource}.{action}. All of them apply to the current workspace only — a permission granted here never leaks to any other workspace.

​
Connect Account (3)

​
Contacts (6)

​
Templates (5)

​
Campaigns (6)

​
Template Bots (5)

​
Message Bots (5)

​
Bot Flows (4)

​
Sources (4)

​
Statuses (4)

​
Groups (4)

​
Custom Fields (4)

​
AI Prompts (4)

​
Canned Replies (4)

​
Chat (3)

​
Activity Log (2)

​
WhatsApp Settings (2)

​
System Settings (2)

​
Staff (4)

​
Roles (4)

​
Email Templates (2)

​
Sensible role presets

Xobito doesn’t ship any of these — they’re just patterns you can build yourself.
Just tenant.chat.view. Lets the teammate answer conversations and nothing else.
Agent, plus tenant.contact.view, tenant.contact.edit, tenant.canned_reply.view, tenant.template.view. Can look up a contact, use canned replies, and see templates.
Contact view/create/edit/bulk_import, templates view/create/edit/load_template, campaigns view/create/edit/show_campaign/bulk_campaigns.send, groups all four, statuses/sources all four, custom fields view.
Everything except: tenant.staff.delete, tenant.role.delete, tenant.whatsmark_settings.edit, tenant.system_settings.edit, tenant.connect_account.disconnect, tenant.activity_log.delete. Keeps the dangerous things for the workspace owner.
Every *.view permission, plus tenant.activity_log.view. Can see everything, can’t change anything.

​
Permissions that need extra thought

A handful of permissions are essentially “keys to the kingdom” because they let the holder grant themselves more access. Give them only to your most trusted teammates:
  • tenant.role.create, tenant.role.edit — can invent a role with any permission set
  • tenant.staff.create, tenant.staff.edit — can reassign roles for any user
  • tenant.connect_account.disconnect — can sever your Meta Business connection
  • tenant.whatsmark_settings.edit, tenant.system_settings.edit — can change core workspace behaviour
  • tenant.activity_log.delete — can erase the audit trail

Staff Members

Invite, edit, and remove staff; assign roles.

Activity Log

Audit trail of actions taken in your workspace.