Roles and permissions
The User and Manager groups, the access rules behind them, and how credentials are kept out of reach.
The module defines two groups in the AI Growth Workforce category.
The groups#
| Group | Purpose |
|---|---|
| User | Can draft posts and submit them for approval. Cannot approve, cannot publish without approval, cannot see platform credentials. |
| Manager | Can approve and publish posts, manage platform credentials and set agent autonomy levels. Implies User. |
Two defaults keep existing people working: every internal user becomes a User, and anyone with Settings access (base.group_system) becomes a Manager.
Access rights per model#
| Model | User | Manager |
|---|---|---|
| AI agents | read | read, write, create, delete |
| AI activity log | read | read only |
| Telegram bots and channels | read | full |
| Facebook accounts | read | full |
| Instagram accounts | read | full |
| WhatsApp accounts | read | full |
The base module gives every internal user full access to the models that hold bot tokens and page access tokens. This module replaces that with the table above, so a User can see that a channel exists but cannot read or change its credentials.
What is Manager-only#
- Approve and Reject posts.
- Activate and Pause agents, and change an agent's Autonomy.
- Publish a post that has not been approved (a manager's click is the approval).
- Create, edit and delete agents, bots, channels and accounts.
A User who presses a Manager button gets: "Only a Social Media Manager can approve posts."
The activity log is read-only for everyone#
There is no create, write or delete permission on the activity log for any group. Entries are created by the system on behalf of the action being logged.
Multi-company#
Global record rules limit posts, agents and activity entries to the user's allowed companies. Without them, tenants in a multi-company database would see each other's drafts. Records with no company are visible to everyone.
Giving someone a role#
See Users and access.
Warning
The Manager default for Settings users means an administrator can approve their own posts. If separation of duties matters to you, give administration and approval to different people, and take Manager off anyone who should not approve.