Desk roles

Enterprise feature (1.19.0, helpdesk). See the Helpdesk overview.

Two layers decide what someone can do in the helpdesk:

1. Workspace permissions (Settings → Roles & permissions) decide who reaches the desk at all: Work helpdesk tickets (helpdesk.agent), Work every team’s tickets (helpdesk.agent_all), Configure the helpdesk (helpdesk.admin) and Read helpdesk reports (helpdesk.reports). See Roles & permissions.
2. A desk role decides what they may do once they are there. Each agent has one: Newbie, Agent, Team lead, Manager or Admin.

Team membership decides which queues a person works: an agent sees the tickets of the teams they belong to, plus tickets assigned to them.

The five roles

Role	Out of the box
Newbie	Works their teams’ queues. Public replies wait for a team lead’s review before they are sent. Internal notes, taking a ticket, macros and their own stats.
Agent	Replies directly, changes status and priority, transfers tickets to other teams, merges duplicates and edits tickets in bulk, links tickets to a major incident, keeps personal macros and canned responses.
Team lead	An agent who also assigns work in their teams, reviews newbies’ replies, keeps team macros and canned responses, reads team reports, overrides a ticket’s SLA, runs major incidents and manages the people in their teams.
Manager	Works every team, assigns to anyone, exports, reads every report, and runs the helpdesk’s configuration: reply targets and hours, automations, every macro, request types, workflows, the survey, teams, and desk roles below their own.
Admin	Everything, including the email channel, email templates, integrations, contact cards, setup, the customer portal, retention, import and the roles matrix. Admin holds every capability except Reply after review, so an Admin’s replies are never held.

Assigning desk roles

Desk settings → Agents lists who works the desk, at which level and in which teams. Add someone, choose their role and their teams (optional for Managers and Admins), and save. Remove from desk takes away their desk role and their teams; their tickets stay assigned to them until someone reassigns them.

• A Team lead with Manage people in their teams adds and removes newbies and agents in their own teams, and only there. They can’t make anyone a lead, and Managers, Admins and other leads stay in the team whatever a lead saves.
• Assign desk roles gives people a role below your own; only Managers and Admins hold it.
• Someone who holds Configure the helpdesk in the workspace is always desk Admin (“Set by their workspace role”). Change that in Settings → Roles & permissions, not here.

Before an admin assigns a role, people who already hold helpdesk permissions get a matching one: Work every team’s tickets with Read helpdesk reports is Manager, a team’s lead is Team lead, and Work helpdesk tickets is Agent. Nobody who worked tickets loses access.

The workspace permissions also stay as floors: Work every team’s tickets always sees every team, and Read helpdesk reports always reads every report, whatever the desk role says.

Changing what a role can do

Desk settings → Roles is a matrix of capabilities by role, in six sections (1.19.2 renames Macros to Macros and canned responses):

Section	Capabilities
Tickets	See their teams’ queues · See every team’s tickets · Take a ticket · Assign within their teams · Assign to anyone · Change status · Change priority · Transfer to another team · Merge tickets · Bulk edit · Link tickets to a major incident · Run major incidents · Override a ticket’s SLA · Export tickets · Delete tickets · Delete for good (1.19.4)
Replies	Reply to the requester · Reply after review · Add internal notes · Review newbies’ replies
Macros and canned responses	Use macros · Personal macros and canned responses · Team macros and canned responses · Everyone’s macros and canned responses
Reports	Their own stats · Team reports · All reports
People and teams	Manage people in their teams · Assign desk roles · Manage teams
Configuration	SLA and business hours · Automations · Request types · Workflows · Satisfaction survey · Email channel · Email templates · Helpdesk settings · Roles and capabilities

Rules the matrix keeps:

• Admin’s column is locked: Admin has every capability except Reply after review (in 1.19.0 it held both, so every Admin reply was held for review; fixed in 1.19.1).
• Roles and capabilities and Assign desk roles are for Managers and Admins only.
• A role holds Reply to the requester or Reply after review, never both.
• You change only roles below your own, and only capabilities you hold yourself. Holding one of Reply to the requester and Reply after review lets you grant the other, and Admins may grant every capability, so an Admin can still give a role Reply after review.
• Team capabilities (see their teams’ queues, assign within their teams, merge tickets, bulk edit, link tickets to a major incident, run major incidents, team macros and canned responses, team reports, manage people in their teams) apply in the teams the person belongs to.
• Bulk edit opens the queue’s bulk bar; each change in it still needs its own capability (see Bulk edits).
• See their teams’ queues decides whether someone sees their teams’ tickets at all. Tickets assigned to them always show.

Save applies from each person’s next action. Reset to defaults puts every role you can change back to what it could do out of the box.

Merge tickets and Bulk edit are new in 1.19.1 (they were held back from the 1.19.0 matrix), on for Agent and above. A role you customised in 1.19.0 gets them only where they build on what it can already do: Merge tickets if it holds Change status (a merge closes tickets), and Bulk edit if it holds at least one of Change status, Change priority, Transfer to another team or an assign capability. The first time you save the matrix, this is fixed in place; untick either if that role shouldn’t have it. See Merging and bulk edits.

Major incidents (1.19.2)

Two capabilities are new in the Tickets section:

• Link tickets to a major incident (“Link and unlink their teams’ tickets to an open major incident”), on for Agent and above. It is checked on each linked ticket’s team.
• Run major incidents (“Declare one, post updates to everyone affected, set its Get help banner and solve it with its linked tickets”), on for Team lead and above. It is checked on the incident’s team, and also needs Reply to the requester there: a role whose replies are held for review can’t run one.

A role you customised before 1.19.2 gets them only where they build on what it can already do: Link tickets to a major incident if it holds Change status, and Run major incidents if it holds both Change status and Reply to the requester. The first time you save the matrix, this is fixed in place. See Major incidents.

Canned responses (1.19.2)

Canned responses use the macro capabilities, now labelled for both: Personal macros and canned responses (Agent and up), Team macros and canned responses (team leads, for their teams) and Everyone’s macros and canned responses (Managers). Inserting a canned response needs no capability beyond working the ticket, not even Use macros.

Assets (1.19.3)

Assets and Snipe-IT adds no capability. Connecting Snipe-IT in Desk settings → Assets (and, from 1.19.4, switching Intune on or off) needs Helpdesk settings (Admins, out of the box). Anyone who works a ticket can link and unlink its assets, and logging a maintenance record as you solve needs Change status, as solving does. Which assets an agent can find depends on Agents can search all assets, not on the desk role (see Who sees assets).

Recycle bin (1.19.4)

Deleting a ticket now moves it to the recycle bin, so the Tickets section changes:

• Delete tickets (marked Changed on the Roles page) now means “Move their teams’ tickets to the recycle bin, one at a time or in bulk, and restore them within 30 days”. It also opens the Recycle bin view.
• Delete for good (marked New) is “Empty tickets from the recycle bin before their 30 days are up”. Out of the box only Admin holds it.

Both are team capabilities: they apply in the teams the person belongs to, or everywhere with See every team’s tickets.

Upgrade note: before 1.19.4, anyone with Delete tickets deleted tickets for good. Now they move tickets to the bin, and only Admin, or a role you give Delete for good, can delete for good before the 30 days are up. A role you customised before 1.19.4 keeps Delete tickets exactly as you set it (with its new meaning) and never gains Delete for good. There is nothing to run.

New settings pages (1.19.4)

Chat apps, API and webhooks and Appearance in Desk settings each need Helpdesk settings (Admins, out of the box). Every agent can choose their own desk background when the workspace allows it, and any agent who works a ticket can share or print it.

An API token acts as a desk role (Newbie to Manager, never Admin) with chosen teams, through a service account that can’t sign in. It follows this matrix, a customised role included, and can never do more than its role.

Claude in the desk (1.20.0)

Claude in the desk works as the agent who asks, with their desk role and teams, at every level from Newbie up. There is no capability of its own to grant: once an admin turns it on, every agent whose teams have it on sees the Claude button. What Claude reads, drafts and suggests stays within the agent’s role:

• A reply draft needs Reply to the requester or Reply after review, and goes into the agent’s own reply box. A newbie’s reply is still held for review when they send it.
• A note draft needs Add internal notes.
• A suggested change is checked against the role before it is offered, and Apply makes it through the desk with the agent’s own permissions, so a change their role doesn’t allow never goes through.

Desk settings → Claude in the desk needs Helpdesk settings (Admins, out of the box).

Reply review

A role with Reply after review (Newbie, out of the box) writes public replies as usual, but the composer says Send for review: the reply waits, marked Waiting for review, and the requester sees nothing yet. Internal notes are never held.

Team leads (anyone with Review newbies’ replies) find held replies under Reviews in the desk, with a count, and get a notification (“Reply waiting for review”). For each reply they can:

• Approve and send it as written.
• Edit it, then Approve edited reply.
• Return it with a note. The newbie sees the note on the ticket and gets a notification (“Reply returned”); the requester sees nothing.

A lead reviews replies from newbies in their own teams; a Manager or Admin reviews any. Files attached to a held reply stay with the desk until it is approved. A macro reply from a newbie is held the same way. Review notices follow each lead’s notification preferences. Every review is in the audit log.

A desk Admin’s public replies are never held. In 1.19.0 they were, by mistake; any Admin reply still waiting from then is under Reviews for a lead to approve and send.

In the audit log

Action	Shown as
helpdesk.agent_role.assigned	Assigned a desk role
helpdesk.agent_role.changed	Changed a desk role
helpdesk.agent_role.removed	Removed someone from the desk
helpdesk.roles.updated	Changed desk role capabilities
helpdesk.roles.reset	Reset desk role capabilities
helpdesk.reply.reviewed	Reviewed a newbie’s reply