Understanding User Roles and Permissions

Understand the different user roles and permissions in Harmony Dashboard, including platform roles, desk roles, and how they affect feature access.

Path: View user roles at /settings/user-management

Overview of User Roles

Harmony uses role-based access control (RBAC) to ensure that every team member only sees and interacts with what is relevant to their responsibilities. Roles are split into two types:

1. Platform roles - Apply across the whole tenant (Admin, Agent, Observer)
2. Desk roles - Apply per service desk (Manager, Agent, Observer)

Your effective access depends on the combination of these roles. Navigation, actions, and visible content all adapt to your assigned role automatically.

Platform Roles

Platform roles are tenant-wide and control access to the main dashboard areas.

Role	Access
Platform Admin	Full access: Dashboard, Tickets, Agents, Workflows, Assets, Software, People, Settings. Implicit access to all desks. Cannot be assigned to tickets unless also a Desk member.
Platform Agent	All modules except Settings. The Tickets section is only visible if the user is also a Desk member.
Platform Observer	Read-only access to the same areas as Agent. The Tickets section is only visible if the user is also a Desk member.

Platform roles are assigned through your identity provider (e.g., Okta, Entra ID). Harmony reads them from your JWT on login.

The Employee role has been removed from Harmony. Role assignment is now simplified to the platform roles listed above plus desk roles, reducing confusion when configuring access for your team.

Desk Roles

Desk roles are per-desk and control what you can do on each service desk.

Role	Access
Desk manager	Manages the desk, its teams, and settings. Can access Settings for that desk.
Desk agent	Works tickets on the desk.
Desk observer	Read-only access to the desk.

You can have different desk roles on different desks. Platform Admins have implicit manager-level access to all desks.

Understanding Role Permissions

Access is derived as follows:

• Dashboard, Agents, Workflows, Assets, Software, People - Visible only with a platform role.
• Tickets - Visible with a platform role combined with Desk membership, or any desk-level access.
• Settings - Visible to Platform Admins and desk managers (for their desks).
• Landing page - Platform role → Dashboard; desk-only → first desk; otherwise → Portal.
• Assets - Access to asset listings is governed by your role. Agents and users can only view the assets they are permitted to see, in line with Harmony's broader authorization model.

Desk access comes from your identity provider via groups. Your employee record is linked to desk resources with a manager, agent, or observer relation.

Permissions are applied uniformly across all Service Desk operations, so access control behaviour is consistent and predictable regardless of which service calls are made.

Copilot Chat Access by Role

Harmony's Copilot chat is available to users with the following platform roles:

Role	Copilot Access
Platform Admin	✓
Platform Agent	✓
Platform Observer	✓

Copilot is not available to users without a platform role (i.e., desk-only access). This means your support agents and observers can take advantage of AI-assisted guidance directly within their existing accounts, without requiring Admin-level access.

API Access Keys and Role-Based Permissions

API Access Keys are subject to the same role-based permission boundaries as your human users. Each key is mapped to an equivalent platform role based on its permission level:

Key Type	Equivalent Role	Capabilities
Read + Write	Platform Admin	Full read and write access
Read-only	Platform Observer	View-only access

This reduces the risk of over-privileged API access and makes it easier to enforce consistent security boundaries across both human users and automated integrations.

Custom Display Names for Roles

You can rename roles in your workspace to better reflect how your team is structured. Instead of being limited to default role names, you can set a custom display name for any role - making it easier to align Harmony's access management with your organization's own terminology and hierarchy.

Role display names are also kept clear and consistent across Access Management, so permissions are easy to understand at a glance when assigning access to team members. No changes to underlying permissions occur when display names are updated.

Viewing Your Assigned Roles

To see another user's roles, go to Settings → User Management → Users, then open the user. The detail view shows:

• Groups - IdP groups with role badges
• Desks - Desks with Desk manager / Desk agent / Desk observer badges

User detail pane with Groups, Desks, and role badges

Your own roles control what you see in the sidebar and where you land after login. There is no self-service "view my roles" page; admins manage roles in the identity provider.

Understanding Role Badges

Role badges appear in:

• Users table - Under the Role column, showing platform and group-derived roles
• User detail - Next to each group and desk

Badges use outline style and show role names such as "Platform Admin", "Desk manager", "Desk agent", "Desk observer". If a custom display name has been set for a role, the custom name appears in place of the default.

Users table with Role column badges

How Roles Affect Access to Features

Feature	Platform Admin	Platform Agent	Platform Observer	Desk-only
Dashboard	✓	✓	✓	✗
Tickets	✓ (all desks, if Desk member)	✓ (if Desk member)	✓ (if Desk member)	✓ (assigned desks)
Agents	✓	✓	✓	✗
Workflows	✓	✓	✓	✗
Assets	✓	✓	✓ (read-only)	✗
Software	✓	✓	✓ (read-only)	✗
People	✓	✓	✓ (read-only)	✗
Settings	✓	✓ (if desk manager)	✗	✗
Portal	✓	✓	✓	✓
Copilot	✓	✓	✓	✗

Group-Based Role Assignments

Roles are assigned through groups in your identity provider. Harmony does not edit roles directly; it consumes group membership and maps groups to platform and desk roles.

Admins configure role mappings in the identity provider. Changes there sync to Harmony and determine what users can see and do. You can also set custom display names for roles directly within Harmony's Access Management settings to match your organization's terminology.

User and group management happens in your identity provider. Harmony reflects those assignments; it does not let you add or remove users or change their roles in the app.

---

Related Resources

User Management

Manage users, groups, and roles

Managing People

Employee directory and profiles

Managing Your Profile

Update your profile settings and preferences

Navigating the Interface

Master the sidebar, command palette, and keyboard shortcuts