Roles & Permissions

Halo uses a HubSpot-style permission model: a small set of high-level roles that anyone can understand, plus granular per-module permissions for the cases where you need precision. Add a teammate, pick a role, optionally pick a preset, and you’re done. No matrix of 30 checkboxes to wade through.

​

Where to find it

Settings > Team (/dashboard/settings/team). You need the Admin or Super Admin role to manage teammates.

​

Roles

Every teammate has exactly one role. The first user who signs up for a workspace automatically becomes the Super Admin and the billing contact. Either can be transferred to another teammate later.

​

Promoting and demoting Super Admins

Only an existing Super Admin can promote another teammate to Super Admin or demote a Super Admin back to Admin or Member. We block the demotion or removal of the last Super Admin so an org can never end up locked out: promote someone else first, then change your own role.

​

The billing contact

The billing contact is a separate flag from role. It marks one teammate per workspace as the person who:

• Receives invoices and payment reminders
• Gets billing-related alerts (card expiring, payment failed, etc.)
• Can manage billing settings regardless of their product role

Decoupling the billing contact from “Super Admin” means your finance team can hold billing without needing full product access, and a founder leaving the team can hand billing off without losing top-level admin power until the very end.

​

Transferring the billing contact

Click Transfer billing at the top of the team list, search for any teammate, and confirm. Any Super Admin or the current billing contact can transfer it. If the original billing contact has already left the team, any remaining Super Admin can re-assign it without needing to contact support.

​

Permissions (for Members)

Members get permissions broken down by module, with a hierarchy of access levels. Each higher level includes everything below it. The whole permission grid is one screen with one click per row. No checkbox forest.

​

Preset bundles

Click a preset to fill in every module at once, then tweak from there if you need to. The moment you change anything, the preset switches to Custom.

​

Inviting teammates

1. Click Invite teammate in Settings > Team.
2. Enter the email and (optionally) a name.
3. Pick a role. For Member, pick a preset or set each module’s access level.
4. Optionally check Make this person the billing contact if they should take over billing once they accept.
5. Click Send invitation.

The invitee gets an email with a link to sign up. When they create their account, their role and permissions from the invitation are applied automatically.

​

Editing access

In the team list, click the menu next to a teammate, then Edit access. Change their role, swap preset, tweak any module level, or hand them the billing contact. Save. When you edit your own access, we block changes that would leave the workspace without a Super Admin and warn before you remove your own billing contact status.

​

Removing teammates

From the row menu, choose Remove from team. We block the removal of:

• Yourself (use the row menu on a different teammate to demote yourself first)
• The only Super Admin (promote another Super Admin first)
• The current billing contact (transfer billing first)

Removed users lose access to the dashboard immediately. Their auth account is preserved so they can later be invited back to a different workspace, but nothing in your org is visible to them anymore.

​

How permissions are enforced

Every restricted action is checked server-side before anything happens. The dashboard hides menu items and pages a teammate can’t access (so they don’t see broken UI), but the actual gate is in the API layer. That means there’s no way to “click around” a missing permission, and any custom integration calling Halo’s API on behalf of a Member is bound by the same rules.

​

Examples

​

”Just inbox” seat

Invite as Member, pick the Support agent preset. They see only the Inbox, Contacts, Companies, Knowledge, and Ask AI in the sidebar. Everything else (settings, integrations, automation, agents) is hidden.

​

”Just Ask AI” seat

Invite as Member, pick Custom, set Ask AI to Use and every other module to None. They land directly on Ask AI and have nothing else visible.

​

”Marketing only” seat

Invite as Member, pick the Marketing / Lifecycle preset. They get Automation (including sending broadcasts), Contacts/Companies for audience targeting, and Help Center editing. Inbox and agents are hidden.

​

Finance person

Invite as Member with no permissions, then check Make this person the billing contact. They see only the billing settings (because the billing flag implicitly grants billing:manage). They can update payment methods and view invoices but can’t touch the product.

​

Where to go next