A role decides which parts of the product a person can reach. Getting this right is what lets you bring in an agent, an accountant or an agency without handing over the whole account.
1
What a role actually controls
Every person you add carries at least one role, and the role decides which sections appear for them — someone with Operator signs in and finds Team Inbox and nothing else, while Administrator sees the lot. It's not a per-screen permission list you tune; it's a set of ready-made bundles you pick from, so the question to ask isn't "what should this person be allowed to click" but "which of these jobs are they doing". You set roles when you invite someone and can change them any time from Edit User.
2
The nine roles
Nine roles, and most of them open exactly one section. The two to think hardest about are Administrator and Developer, because they're the two that can reach everything — including billing and the ability to add more people.
Administrator — everything, including billing, settings and adding other people. Also placed in every team automatically.
Developer — the same full access as an Administrator, intended for whoever wires up the API and connectors.
Operator — Team Inbox only. The everyday agent role: answer chats, nothing else.
Broadcast Manager — Team Inbox only, same reach as Operator.
Template Manager — Campaigns only, for whoever writes and sends broadcasts.
Contact Manager — Contacts only, for whoever curates your lists and segments.
Automation Manager — Automations only, for whoever builds chatbots and rules.
Dashboard Viewer — Dashboard and Analytics, read-only in spirit: numbers without the inbox.
Billing Manager — Dashboard, Analytics and Settings, for the person who handles the plan and invoices.
3
Roles add up — they never cancel out
You can give someone several roles, and the result is always the sum of them: Operator plus Dashboard Viewer gets the inbox and the dashboard. There's no role that takes something away, so adding one can only ever widen what a person can reach, never narrow it. That makes combinations easy to reason about — pick the jobs someone does and add a role for each — but it also means you can't start from Administrator and subtract. If someone shouldn't see billing, the fix is to not give them Administrator in the first place, rather than to layer something on top. The Role column in the users table shows everything a person currently holds.