Zodiac Tech CRM Docs

Roles & who does what

Every real role on the platform, the panel it signs into, what it can do, and what it deliberately cannot do.

everyone Easy ⏱ 7 min Updated 2026-10-05

Roles & who does what

Nine roles exist in the product, across three panels. A person's role decides which panel they sign into and what they see once inside.

Role Panel What they do What they can't do
admin — Business Admin / Owner /admin Everything in their own workspace: leads, team, WhatsApp, ads tools, reports, settings, Billing portal, guided setup. Touch any other business; open the Super Admin or agency panels.
manager — Sales Manager /admin Run day-to-day: all lead actions incl. delete/import/export/assign, pipelines, forms, automations, reports, invite/edit team members, send WhatsApp and manage templates, manager-tier settings (General, Branding, Business hours, Team). Open the Billing portal; change admin-only settings (Email/SMTP, WhatsApp connection, Security, API keys, Storage, AI, Messaging, Queue, Realtime); grant or revoke the admin role; edit or delete an admin.
member — Sales Agent /admin Work leads: view, create, edit and assign; move stages; log calls; send WhatsApp; view follow-ups, forms, reports. Works from the Android app too. Delete or export/import leads; manage team, settings, ads campaigns, billing, or automations.
super_admin — Platform Owner /super-admin Manage every business, user and agency staff member; run the Client Onboarding dashboard; configure Meta Developer credentials, billing providers, mobile app settings, backups and updates. Nothing platform-side — this role bypasses all gates. It is intentionally rare.
account_manager /agency Own client delivery: Setup Queue, client workspace info, connect Meta, Client Requests, Support Desk, Live Chat, performance views. Launch or pass QA (meta.campaign.launch is not granted); create/edit campaigns; edit creatives.
ads_specialist /agency Meta setup for clients, campaign building and pausing (permission set), Active Campaigns, Needs Attention, performance and portfolio views. Pass QA / go live; manage creative work; edit client info; support desk.
creative_specialist /agency Create and edit creatives in Creative Work (versioned); view campaigns and performance read-only. Setup Queue work, client edits, support, launching anything.
qa_reviewer /agency The only role with campaign launch rights: run the QA Queue and pass/fail campaigns after the 12-point checklist. Everything else is view-only — no setup, no creatives, no support.
support_agent /agency Client Requests, Support Desk and Live Chat; can help connect a client's Meta when needed (meta.connect). Launch campaigns, manage creatives, edit client workspaces, work the Setup Queue.

Business roles (/admin)

Owner — admin

The workspace owner. Has every permission by definition (the admin role is granted all permissions, and the HasRolePermissions gate passes role-admins unconditionally). Only the owner (or another Spatie admin) can open the Billing portal and the guided setup wizard's admin-only surfaces. Full guide: Business Admin / Owner.

Sales Manager — manager

Created for the person who runs the sales floor. Can do everything with leads — including delete, import, export and bulk-assign — plus pipelines, forms, automations, reports, team invites and WhatsApp templates. Two deliberate limits: team.manage is withheld (only an admin can remove an admin or change someone to admin), and admin-only settings stay closed (credentials, connections, security). Full guide: Sales Manager.

Sales Agent — member

The daily phone-and-follow-up role. Leads, calls, WhatsApp, follow-ups, appointments — that is the job. Leads can be viewed/created/edited/assigned but not deleted or exported; workspace configuration, ads management and billing are invisible. Full guide: Sales Agent.

Platform role (/super-admin)

Super Admin — super_admin

The company running the install. Creates businesses and users, watches the onboarding pipeline, holds the Meta app credentials, runs the billing console, manages the agency team and the Android fleet, and owns system health/backups. See Super Admin and the Client delivery playbook.

Agency roles (/agency)

All five agency roles live in one panel and are gated by granular meta.* permissions (AgencyRolesSeeder::ROLE_PERMISSIONS). The split exists for one hard rule: a support person must never inherit launch rights — only qa_reviewer can pass QA and launch.

Visibility vs access Hiding a sidebar item and denying access are two independent layers. Some manager-level pages are simply hidden from sales agents to keep their menu short, while permission-gated pages enforce access on the URL too. See RBAC for the technical model.

How roles are assigned

  • Business owner: created by the platform team when the workspace is made (or by public registration at /register when enabled).
  • Managers and members: invited from the workspace — Team Members, or Settings → Team.
  • Super admins: promoted by another super admin in Users.
  • Agency staff: created by the platform team at /super-admin/meta-ads/agency-team, with a one-click Enable/Disable launch access toggle that adds or removes only the qa_reviewer role.

Was this page helpful?