📋 Reference · Last updated: September 17, 2026

<aside> 🔐

WHAT IT DOES

Roles decide what each teammate can do in your workspace — from simply watching performance, to building agents, taking them live, and managing the whole team. You pick a role when you invite someone, and you can change it any time.

</aside>

How roles work

Everyone you invite to a workspace gets one role. That role is a ready-made bundle of permissions, so you don't have to set access one checkbox at a time. The same role applies everywhere in that workspace.

The Workspace Users screen: each teammate with their assigned role, a pending invitation, and controls to change a role or check access. Sam, who created the workspace, shows as the Owner.

Zammo Agents comes with five built-in roles, listed below from least to most access. Give each teammate the least access they need to do their job. On paid plans, an Admin can also create custom roles with a tailored mix of permissions.

The five built-in roles

• Viewer — Read-only. Can see agents, dashboards, conversation logs, and knowledge content, but can't change anything. Good for a Riverton department head who just wants to watch how the Riverton 311 agent is performing.
• Editor — Everything a Viewer can see, plus builds and edits agents and updates knowledge. Good for the team member designing the Report an Issue agent.
• Publisher — Everything an Editor can do, plus takes agents live, exports conversation logs, and removes knowledge. Good for the person responsible for launching Riverton 311 to residents.
• Content Manager — Focused on knowledge, not agent building. Keeps sources current — add, update, and remove knowledge — and can view agents, dashboards, and logs, but can't build or publish agents. Good for a records specialist who maintains the Waste Collection Schedule and Permit Guidelines.
• Admin — Full control of the workspace: everything above, plus inviting teammates, assigning roles, editing workspace settings and branding, and managing data tables and connections. Good for the 311 program manager who runs the whole workspace.

The Roles tab showing the five built-in roles — Viewer, Editor, Publisher, Content Manager, and Admin — each with its plain-language description and the permissions it includes.

What each role can do

Each column is a role. ✓ means the role includes that ability; a blank means it does not.

How access is scoped

• Roles apply across the whole workspace. A person's one role sets everything they can do — there isn't a separate role per agent.
• Private agents add a second layer. An agent can be marked private so it's hidden from the rest of the workspace. Only people who have been given access to that agent can open it — and once inside, their workspace role still decides what they can do.
• Check Access. On the Workspace page, use Check Access to confirm exactly what a specific teammate can see and do before you rely on it.