Roles and Permissions
Access to Agentic is decided by the platform role held on an organisation membership. Two roles can use it: Admin and Organisation Admin. Both build and run agents. Organisation Admins also own Settings, where the Twilio connection and human escalation live, and they can see and revoke every connected app in the organisation.
The canonical definition of each role, the role hierarchy and invite rules are documented once, in the platform docs: NeonNow Roles and Permissions. The platform docs call the Organisation Admin role Org Admin. This page describes what each role can do within Agentic.
Which Roles Can Use Agentic
| Role | Sees Agentic? | Summary within Agentic |
|---|---|---|
| Organisation Admin | Yes | Everything an Admin can do, plus Settings and managing every connected app in the organisation |
| Admin | Yes | Environments, agents, testing, publishing, sessions and metrics, and connecting AI apps |
| Campaign Manager | No | Agentic is not in the sidebar |
| Campaigner | No | Agentic is not in the sidebar |
| Operations | No | Agentic is not in the sidebar |
Someone without access who follows a link to a Agentic page sees a page-not-found message. To give them access, an Admin or Organisation Admin changes their role in User Management.
Admin
An Admin has full use of the building side of Agentic. An Admin can:
- Turn Agentic on by creating the first environment, then create, edit and delete environments
- Build agents with IQ or by hand, and edit them in the agent editor or Quick Config
- Test drafts in the playground
- Publish agents, discard draft changes, enable, disable and delete agents
- Assign a phone number to a Frontline agent, once an Organisation Admin has connected Twilio
- Read sessions and metrics
- Connect an AI app, approve its access, and disconnect their own connections
An Admin cannot open Settings. Settings is not shown in the sub navigation, and steps in the Getting started checklist that need Settings show Copy link for admin instead of a link. The copied link opens the right settings page for an Organisation Admin.
Organisation Admin
An Organisation Admin can do everything an Admin can, and also opens Settings for each environment:
- Integrations: Twilio, and Connected Apps, which lists every connected app in the organisation and can revoke any of them
- Contact Centre: Human Escalation, and once it is on, Twilio Resources, Wrap, Routing and Capacity
Until an Organisation Admin connects Twilio, no agent in the environment can have a phone number, and human escalation cannot be used. Agents can still be built, tested and published.
Connected Apps and Roles
A connected app acts as the person who connected it, in the organisation they chose. Roles decide who can connect one and who can remove one.
- Connecting needs the Admin or Organisation Admin role in the chosen organisation. On the approval screen, an organisation where the person holds neither role is marked Needs Admin access and cannot be chosen.
- Access is chosen at approval: Read Only, or Read and Write for building and managing agents. Even with write access, a connected app cannot delete agents, change Twilio, routing, wrap or capacity, or see secrets or API keys.
- Disconnecting your own happens in Account Settings > Security, for anyone who is an Admin or Organisation Admin in at least one organisation.
- Revoking anyone's happens in Settings > Connected Apps, for Organisation Admins. Revoking ends the app's access immediately.
- Role changes can end access automatically. If the person who connected an app stops being an Admin or Organisation Admin in that organisation, or leaves it, the app loses access within a few minutes. Moving between Admin and Organisation Admin does not affect it.
See What Connected Apps Can Do for the full lists.
The Workspace
The workspace, where people pick up escalated calls and chats, does not check roles. Anyone with an accepted membership in an organisation can sign in to it with their NeonNow account, whatever their role. Someone with no accepted membership in any organisation sees a page asking them to contact an administrator to be added, with Manage Account and Sign Out buttons. Whether a person is offered contacts depends on the human escalation setup an Organisation Admin manages, not on their role.
Access Matrix
Campaign Manager, Campaigner and Operations are left out of the table. They have no access to Agentic in the Admin app, and like every role they can sign in to the workspace.
| Capability | Admin | Organisation Admin |
|---|---|---|
| See Agentic in the sidebar | Yes | Yes |
| Turn Agentic on by creating the first environment | Yes | Yes |
| Create, edit and delete environments | Yes | Yes |
| Build agents with IQ or by hand | Yes | Yes |
| Edit agents in the editor or Quick Config | Yes | Yes |
| Test drafts in the playground | Yes | Yes |
| Publish agents and discard draft changes | Yes | Yes |
| Enable, disable and delete agents | Yes | Yes |
| Assign or change an agent's phone number | Yes | Yes |
| Read sessions, transcripts and metrics | Yes | Yes |
| See the Getting started checklist | Yes | Yes |
| Open Settings | No | Yes |
| Connect Twilio and correct its credentials | No | Yes |
| Turn on and configure human escalation | No | Yes |
| Connect an AI app and approve its access | Yes | Yes |
| See and disconnect your own connected apps in Account Settings > Security | Yes | Yes |
| See and revoke everyone's connected apps in Settings > Connected Apps | No | Yes |
| Sign in to the workspace to handle escalated contacts | Yes | Yes |
Inviting users and assigning roles happen in the NeonNow Admin app rather than in Agentic. See User Management and Organisation Settings.
Related Guidance
- NeonNow Roles and Permissions. Canonical role definitions and rules
- Getting Started. Who does what to get an environment running
- Settings. What an Organisation Admin configures
- Managing Connections. Revoking connected apps across the organisation