Roles & Permissions
SupportHub uses Spatie Permission. The seeded Admin role receives all permissions. The seeded Agent role receives the core ticket, organization, playbook, issue group, context hub, notification, and activity log permissions needed for day-to-day support work.
Role Management
/roleslists roles.- Users with create, edit, or delete role permissions can manage roles.
- Role changes are reflected in the permission-aware sidebar and route middleware.
Permission Glossary
/permissions shows the permission glossary. Admins can update glossary metadata such as title, description, module, risk, sort order, and visibility. This keeps permission explanations understandable for buyers and administrators.
Permission Groups
| Group | Examples |
|---|---|
| Settings and Tools | edit settings, use tools |
| Security | totp setup, manage enterprise identity, impersonate users |
| Notifications | view notifications, manage notifications, view activity logs |
| Roles and Users | view/create/edit/delete roles, view permissions, view/create/edit/delete users, assign user roles |
| Ticket Setup | manage categories, priorities, statuses, SLA policies, tags, custom fields, mailboxes, business hours, reply templates, FAQ entries |
| Tickets | view, create, assign, reply, notes, status, priority, bulk, merge, split, time tracking |
| Case Files | view case files, manage case files, delete case files, view sensitive case files, export case files |
| Customers | view/manage organizations and support contracts |
| Playbooks and Automation | view/manage playbooks, work ticket playbooks, view/manage automations |
| Reports | view reports, export reports, manage report schedules |
| Integrations and Operations | manage API clients, manage webhooks, view operations center, manage recovery suite |
Least Privilege
Do not give every user the Admin role. Start agents from the Agent role, then add permissions only when a workflow requires them. Treat role assignment, settings, API clients, recovery, impersonation, identity, export, and delete permissions as sensitive.
Sidebar Visibility
The sidebar checks permissions before showing menu groups. Missing menu items usually mean the user lacks permission, not that the route is missing.
