Access and visibility policy

Access and visibility policy · Help

The access and visibility policy decides what each role on your team sees in the panel. The role says what a person can do; the policy says what they can see. Because the two are kept apart, you can let an agent reply to messages while limiting their field of view to their own conversations.

⚠️ Note: only people who can assign conversations may write the policy, that is the portfolio owner and its administrators. If the portfolio is scheduled for deletion, the policy cannot be saved.

What the policy decides

Per role, the policy decides three things:

Conversations — Which conversations someone in that role sees.
Contacts — Who they see in the contact list and on contact cards.
Sections — Which sections of the left menu are open to them.

The policy belongs to the portfolio: it applies identically across every account in it. There is no per-account policy.

✅ A closed section does not merely disappear from the menu: its page will not open either. Someone typing the address and someone arriving from a notification get the same result. Hiding a menu item is not security on its own; the gate sits on the page and on the data itself.

Which roles the policy covers

The policy is configured separately for editor, agent and viewer. Owners and administrators are outside it: there is no point in the people who run the portfolio hiding things from themselves, so they always see everything.

On the screen each role has its own block, with a line underneath the heading saying what the role is for:

Editor — Builds and publishes flows.
Agent — Answers conversations.
Viewer — Reads only, changes nothing.

Conversation scope

The Conversations list offers three options:

Only assigned to them — They see only conversations assigned to them, and never the unassigned pool.
Assigned to them and unassigned — They see their own work plus the unassigned pool. Use this when someone should be able to pick work up but not read a colleague's conversation.
All conversations in the account — No restriction.

The scope also binds the inbox tabs. For a restricted agent, the "Unassigned" tab cannot show more than the policy allows. The same rule applies when opening a conversation from its address, from a notification link, or from a contact card.

Contact scope

The Contacts list offers two options:

Only contacts from their own conversations — The contact list, the contact card, bulk tagging and CSV all apply the same rule.
All contacts in the account — No restriction.

When contact scope is limited to "their own conversations", their own means the conversations assigned to them. Even if conversation scope is "all conversations", a narrowed contact scope still produces only the contacts of conversations assigned to that person.

Sections

Under Sections there are six checkboxes:

Automations
My profile and Publishing
Insights
Reports
Media
Contacts

Clearing a checkbox closes that section for everyone in that role.

⚠️ Note: the inbox is not in the list and cannot be closed. It is the reason a team member opens the panel at all. Settings is not in the list either; its contents are already filtered by role permissions.

Opening a section requires two conditions together: the role must hold the permission, and the checkbox must be ticked. That is why ticking Reports for an agent does not open it — the agent role has no permission to view reports. In the same way Insights and My profile and Publishing exist only on Instagram accounts; on a WhatsApp account the section stays hidden even with the box ticked.

Default settings

If you never touch the policy, these defaults apply:

Editor

Conversations: all conversations in the account. Contacts: all contacts in the account. Sections: Automations, My profile and Publishing, Reports, Media and Contacts are on; Insights is off.

Agent

Conversations: only assigned to them. Contacts: only contacts from their own conversations. Sections: Media and Contacts are on; Automations, My profile and Publishing, Insights and Reports are off.

Viewer

Conversations: all conversations in the account. Contacts: all contacts in the account. Sections: Automations, Reports, Media and Contacts are on; My profile and Publishing and Insights are off.

The defaults are aligned with what each role can actually do: showing a screen that nobody in that role can touch was only misleading.

Changing the policy

Open Portfolio settings › Conversation assignment rules.
Expand the Access and visibility section.
In the block for the role you want to change, pick the scope from the Conversations list.
Pick the contact scope from the Contacts list.
Tick or clear the boxes under Sections.
Repeat for the other roles.
Press Save. One button writes the whole policy; there is no half-saved state.

Further down the same page is the Assignment of new conversations section: whether an incoming conversation is assigned automatically (no assignment / balanced / always the same person) and the maximum number of open conversations per person. They share a page because both answer the same question: who handles what.

What happens when you change the policy

The policy you save applies across every account in the portfolio and takes effect the next time someone opens a page; nobody has to sign in again.

When you close a section, people in that role no longer see it in the menu and cannot open its page. Refreshing an already-open tab returns a page-not-found result.
When you narrow the conversation scope, the person sees only the conversations within it. Conversations assigned to them stay assigned; nobody's assignment changes.
When you widen it, new conversations appear in the list by themselves; no history is deleted, only visibility changes.

The policy changes visibility alone: it removes nobody from the team and deletes no data.

A concrete example

An online shop runs two agents and has an intern as editor.

For the agent role the conversation scope is set to Assigned to them and unassigned: both agents can pick work up from the pool, but neither reads the other's conversation. Contact scope is left at their own conversations, so the whole customer list never leaves the account.
For the editor role Reports stays on while Contacts is switched off: building campaign flows does not require access to the customer list.
For an external consultant added as viewer, only Reports is left on. The conversation scope cannot be narrowed below "all conversations" for a viewer who should not read the inbox at all — in that case the right decision is not to add them to the team.

Common mistakes

Believing that hiding the menu leaves the data open. Used properly, the policy closes both the menu and the page. Nothing else is needed.
Ticking Reports for agents. It will not open, because the role holds no permission for it. Give the person who needs reports the Viewer or Editor role.
Trying to close the inbox. It cannot be closed. If someone must not see conversations at all, do not add them to the team.
Looking for a per-account policy. The policy belongs to the portfolio and is identical across its accounts. If you need different rules, split the accounts into separate portfolios.
Closing a section and asking why someone still sees it. Owners and administrators are outside the policy; that person is very likely an administrator.

Set the policy once and everyone who joins the team afterwards starts with the right field of view on day one.