#Roles & Permissions

#Overview

Every AiDial portal user is assigned a role that determines what they can see and do. Roles are resolved from the signed-in identity and the tenant/project scope attached to the account. Individual users cannot change their own role in the portal.

Route and action permissions are enforced by the portal service, not by the menu that appears in the browser. Sidebar visibility is a convenience, not a security boundary: some sections are authorised for your role but deliberately left out of the sidebar, and every link you can see is still re-checked on the server. If you request a tenant, project, page, or action outside your scope, the portal returns a not-found response without exposing whether the resource exists.

#Customer Roles

These roles are for users who belong to a single AiDial client organisation.

#Client Administrator (client_admin)

The primary administrative role for a client organisation. Client administrators have the broadest customer-facing access, scoped to their tenant and assigned projects.

Can access:

• Overview (dashboard) analytics
• Calls list, with call review opening inline on the Calls page for assigned projects
• Redacted transcript download (TXT) from the inline review panel
• Call exports with metadata and redacted summaries; caller-information and transcript-text options are shown as governed and unavailable, and audio links are not offered
• Compliance: Consent, Data retention, Evidence trail, Caller requests, and Reports
• Billing overview, invoices, usage, payment details, and the billing portal for their own tenant
• Support tickets and notifications
• Settings for the selected project. Business hours, Notifications, and Reports appear in the Settings rail; Call limits, Transfer settings, Consent message, Tenant settings, IP allowlist, Secondary use, Active sessions, Data exports, and Data deletion stay authorised and are reached by direct link
• Account: Profile, and Security (multi-factor authentication, active sessions, notification preferences)
• Audit log for their own tenant
• Status page

Team and user management — adding, removing, changing roles, and managing another user's sessions — is handled by your AiDial partner. It is not a customer portal feature for any customer role, including client administrators.

Multi-factor authentication: Optional (recommended). It may still be required by an explicit tenant or user policy from the identity provider. See Multi-Factor Authentication.

#Client Manager (client_manager)

A senior customer role with broad visibility and limited management capabilities compared with the client administrator.

Can access:

• Overview (dashboard) analytics
• Calls list and inline call review for assigned projects, including caller search
• Call exports (call metadata only)
• Compliance: Consent and Evidence trail
• Billing overview, invoices, usage, payment details, and the billing portal for their own tenant
• Support tickets and notifications
• Settings: Notifications and Reports are visible, and Business hours, Call limits, Transfer settings, Consent message, Tenant settings, IP allowlist, and Secondary use are read-only summaries
• Account: Profile and Security. Your own profile and active sessions live under Account, not under Settings
• Audit log for their own tenant
• Status page

Key difference from client_admin: client managers can read most operational settings but cannot save changes to any of them — including Notifications and Reports, where the panel is visible but only client administrators can save. They also get no transcript-download button in call review — although the download route itself still authorises client managers, so treat transcript access as a real client-manager entitlement — plus no sensitive export options, no Data retention, Caller requests, or Compliance reports pages, and no data export or data deletion requests.

Multi-factor authentication: Optional (recommended). It may still be required by an explicit tenant or user policy.

#Client Staff (client_staff)

A standard customer user role for day-to-day operational access.

Can access:

• Overview (dashboard) analytics
• Calls list and inline call review for assigned projects, with the caller number masked and caller search disabled
• Call exports (call metadata only)
• Support tickets and notifications
• Settings: Reports only, and read-only
• Account: Profile and Security (multi-factor authentication and your own active sessions)
• Status page

Cannot access:

• Billing
• Compliance section
• Audit log
• Transcript download and PII unlock
• The caller-information and transcript-text export options
• Notification settings
• All operational and tenant settings, including business hours, call limits, transfer settings, consent message, IP allowlist, tenant settings, secondary use, data governance, data exports, and data deletion

Multi-factor authentication: Optional (recommended). It may still be required by an explicit tenant or user policy.

#Customer Role Comparison

Notes on the table:

• Recording playback and download are not available in the portal for any role. The portal does not offer recording controls because there is no implemented recording locator or media-access contract behind them. Recording-related eligibility is reported as unavailable for every role.
• PII unlock is a request-only path: it never returns unredacted content in the call review surface. Client administrators and client managers are permitted to submit unlock requests, but the portal does not currently present a PII unlock control on the call review surface.
• Call review is inline. The standalone call detail page has been retired; links to it redirect to the Calls page with the call expanded.
• Some client administrator settings sections are not in the Settings rail. Call limits, Transfer settings, Consent message, Tenant settings, IP allowlist, Secondary use, Active sessions, Data exports, and Data deletion remain authorised and open from a direct link; only Business hours, Notifications, and Reports are listed in the rail.
• The Status page is authorised for every customer role but is not a sidebar item. It is reached by direct link or from an incident banner.

#Partner Roles

These roles are for partner organisations that manage assigned AiDial client accounts. See Tenant Scoping for how partner access works across multiple clients.

Partner access is always scoped server-side to assigned clients/projects. Partner routes that require a target client use explicit client selection; out-of-scope client or project IDs are denied without revealing whether the resource exists.

#Partner Administrator (partner_admin)

The primary partner role with management access across assigned client accounts.

Can access:

• Dashboard analytics for assigned clients/projects
• Calls list and call review metadata for assigned clients/projects. Caller numbers are masked for partner roles, and transcript content is hidden
• Call cost/performance data and call metadata exports for assigned clients/projects
• Partner analytics and alerts
• Capacity overview and history for assigned clients
• Clients page for assigned-client visibility, partner-managed client profiles, and client-user assignment
• Projects workspace for assigned clients, including draft edit, validate, publish, restore, archive, lifecycle, and project assignment actions
• Knowledge bases, including create, edit, delete, rebuild, preview, cleanup actions, and quota overrides
• Telephony inventory for assigned clients
• Outbound campaigns, including campaign management actions
• Integrations: API keys, webhooks, SSO, SCIM, plugins and tools, and provider connections. Webhook create, update, delete, rotate-secret, and test are partner-administrator actions
• Partner team member management, including invitations
• Billing overview, invoices, and billing portal for an explicitly selected assigned client
• Support tickets scoped to assigned clients
• Settings summaries for assigned clients: business hours, call limits, transfer settings, consent message, tenant settings, secondary use, and data governance are read-only; the partner's own profile is editable
• Audit log for assigned clients
• Status page

Partner administrators do not receive customer transcript download, PII unlock, or recording access permissions. Data governance is a read-only summary for partner roles; it is not editable by any portal role.

Multi-factor authentication: Required. See Multi-Factor Authentication.

#Partner User (partner_user)

A read-only partner role with limited visibility across assigned client accounts.

Can access:

• Dashboard analytics for assigned clients/projects
• Calls list and call review metadata for assigned clients/projects, with caller numbers masked and transcript content hidden
• Partner analytics and alerts
• Capacity overview and history for assigned clients
• Clients page in read-only mode for assigned clients
• Projects workspace in read-only mode
• Knowledge bases, telephony inventory, and outbound campaigns in read-only mode
• Integrations in read-only mode, including webhook configuration and delivery history
• Partner team in read-only mode
• Support tickets scoped to assigned clients, and notifications
• Settings summaries for assigned clients: business hours, call limits, transfer settings, consent message, tenant settings, secondary use, and data governance (all read-only)
• Audit log for assigned clients (read-only)
• Status page

Cannot access:

• Billing
• Call exports
• Call cost/performance data
• Customer transcript download, PII unlock, or recording access
• Project, knowledge base, campaign, webhook, integration, client-assignment, or partner-team mutation actions
• Settings editing

Multi-factor authentication: Optional (recommended). It may still be required by an explicit tenant or user policy.

#Partner Role Comparison

#AiDial Operations Roles

AiDial also has operations-only roles for approved internal support and administration work. These roles are not assigned to customer or partner users, and they work from a separate administration area rather than the customer portal surfaces. A small number of shared routes — integrations, audit log, capacity, and status — are authorised for them as well. MFA is required for operations-only roles.

#How Roles Are Assigned

Roles are assigned by your organisation's administrator or by AiDial during account setup. Role changes are not self-service inside the portal; if your role is incorrect, contact your organisation's administrator or AiDial support.

#Next Steps

• Understand tenant scoping for partner roles
• Set up multi-factor authentication
• Learn about API authentication methods