Assign a role to a user

Three flows: assigning at invite time, changing an existing user’s role, and adding a second role to a user who already has one.

Steps — at invite time

When inviting a new user, the role is part of the invite form:

1. Open Settings → Users → New user (or Invite).
2. Fill in the email, name, and other fields.
3. Role — pick from the dropdown. Only roles that exist in the tenant appear (5 standard + any custom roles you’ve created).
4. Send the invite.

The user has the assigned role from their first login. They never have a temporary period without it.

Steps — change an existing user’s role

For users who already exist and need a role change:

1. Open Settings → Users.
2. Find the user. Click into their profile.
3. Open Roles.
4. Either:
   Replace primary role — pick a different role from the dropdown
   Add additional role — click Add role, pick from the dropdown
5. Save.

The change takes effect on the user’s next page load. They may need to sign out and back in for permissions to refresh fully.

Multiple roles per user

Users can have multiple roles. Their effective permissions are the union — they get every permission granted by any of their roles.

Example: a user with both Agent and Knowledge Curator can handle conversations (Agent permissions) AND edit Knowledge Base articles (Knowledge Curator permissions).

This is useful when you have orthogonal capability bundles — e.g., a Team Lead role that’s strictly about supervision combined with a Specialist role that grants subject-matter-specific permissions.

Sole-owner protection

Atender prevents removing the last Owner from the workspace. If a user has the Owner role and they’re the only Owner:

• You can’t remove the Owner role
• You can’t deactivate the user
• You can’t delete the user’s account from the tenant
• You CAN add a second Owner first, then remove the first

This is intentional — losing all Owner-level access locks the workspace and requires support intervention to recover.

Steps — bulk role assignment

There’s no built-in bulk role-assignment UI today. For large changes (e.g., onboarding 50 users with the same role):

1. Use the standard invite flow per user, picking the right role each time. Tedious but reliable.
2. Or, use the API: POST to /api/users for each invite, with the role specified in the body. See API Keys for setup, and the API documentation for the user-invite endpoint.

For changes to existing users, the same applies — UI is per-user; API is bulk-friendly.

Verify it worked

1. Open the user’s profile.
2. Confirm the assigned roles match what you expected.
3. Optionally, ask the user to sign out and back in. They should see the updated permissions reflected in what they can do — settings pages they couldn’t see before, or the loss of access to features their previous role granted.

Troubleshooting

• Symptom: User can’t see settings even though they’re assigned an Admin-equivalent role. Fix: Have them sign out and back in. Permission changes mid-session sometimes need a fresh login to fully apply.
• Symptom: Tried to remove a user’s only role; got an error. Fix: Every user must have at least one role. Add a different role first (e.g. Reader), then remove the original.
• Symptom: Can’t remove the user’s Owner role. Fix: Sole-owner protection. Add another Owner first, then revisit.

See also

• What are Roles and Permissions?
• Create a custom role
• Invite a user