Roles and access
Owner, admin and member, and the four access levels each person has per module.
Every person in a workspace has a role and, for each module, an access level.
Roles
| Role | Typical person | Manages members | Phone numbers and webhooks | Billing |
|---|---|---|---|---|
| Owner | Clinic owner | Yes | Yes | Sees it; changes only through billing |
| Admin | Practice manager | Invites members and sets their levels, not the owner's | Yes | Sees it |
| Member | Front desk | No | No | No |
AI agents are not members. They are configured in Scripts.
Access levels
| Level | What it allows |
|---|---|
none | The module is hidden. Its rows return nothing, even through the API. |
view | Read pages and records. No changes. |
edit | Day-to-day changes: review calls, add notes, edit drafts, manage bookings. |
publish | Actions that change what callers hear or erase data, such as publishing a script. |
Levels build on each other: publish includes edit, which includes view.
Defaults by role
These are the levels a person gets unless an owner or admin changes them for that person in Settings → Team & access. The table is generated from ROLE_DEFAULTS in @callwise/modules, which mirrors the database function cw_role_default_level().
| Module | Owner | Admin | Member |
|---|---|---|---|
| Receptionist | publish | publish | edit |
| Bookings | publish | publish | edit |
| Callers | publish | publish | edit |
| Analytics | publish | publish | view |
| Outbound | publish | publish | view |
Effective level
What a person can actually do is the lower of two things:
- Their level: the role default, or the per-person override.
- The module's cap, set by billing: a locked or switched-off module caps at
none, a read-only one atview. See Modules and billing states.
Owners always get the full cap. The same rule runs in the app (to hide pages and buttons) and in Postgres as cw_can_access() (to filter rows and refuse writes), so hiding a button is never the only protection.
Rules that protect access itself
- A member can't raise their own level.
- An admin can't change the owner's levels.
- Only the owner can change roles.