Skip to main content

Role Hierarchy

Understand the role hierarchy and permissions in DZDESK.

Role Overview​

DZDESK has three built-in roles arranged in a hierarchy:

Admin (Full Access)
   │
   ├── Agent (Standard Operations)
   │      │
   │      └── Viewer (Read Only)

Each higher role includes all permissions of lower roles.

Admin Role​

Permissions​

Admins can:

User Management

  • Create, edit, deactivate users
  • Assign roles to users
  • Manage group membership
  • Set VIP status

Group Management

  • Create and delete groups
  • Configure group settings
  • Assign group managers

System Configuration

  • Configure SLA policies
  • Set working hours
  • Manage holiday calendar
  • Configure integrations

Request Operations

  • All Agent permissions
  • Delete requests
  • Bulk operations
  • Override SLA

Reporting & Audit

  • Access all reports
  • View audit logs
  • Export data
  • System analytics

Typical Admin Users​

  • IT Managers
  • DZDESK System Administrators
  • Service Desk Managers
  • Compliance Officers

Best Practices for Admins​

  1. Limit number of Admin accounts
  2. Use named accounts (not shared)
  3. Regular review of Admin actions
  4. Document administrative changes

Agent Role​

Permissions​

Agents can:

Request Management

  • Create new requests
  • Edit request details
  • Change status
  • Assign/reassign requests
  • Add comments
  • Attach files

Queue Management

  • View group queues
  • Claim unassigned requests
  • Filter and search requests
  • Use saved views

Communication

  • Add public comments
  • Add internal notes
  • View request history

Limited Admin

  • View user list (not edit)
  • See group membership
  • Access own activity

Cannot Do​

  • Create/delete users
  • Manage groups
  • Configure SLA
  • System settings
  • View audit logs
  • Delete requests

Typical Agent Users​

  • Help Desk Technicians
  • Support Engineers
  • IT Support Staff
  • Field Technicians

Best Practices for Agents​

  1. Document all actions
  2. Update status promptly
  3. Use internal notes appropriately
  4. Escalate when needed

Viewer Role​

Permissions​

Viewers can:

Read Access

  • View requests (scope may be limited)
  • See dashboards
  • View reports (if granted)
  • Search requests

Cannot Do

  • Create requests
  • Edit anything
  • Assign requests
  • Add comments
  • Change status
  • Access settings

Typical Viewer Users​

  • Department Managers (oversight)
  • Executives (visibility)
  • Auditors (review)
  • Trainees (learning)

Best Practices for Viewers​

  1. Use for oversight roles
  2. Consider for new employees
  3. Upgrade to Agent when ready
  4. Don't over-use for access restriction

Permission Matrix​

PermissionAdminAgentViewer
Requests
View assigned✓✓✓
View all✓GroupLimited
Create✓✓✗
Edit✓✓✗
Delete✓✗✗
Assign✓✓✗
Users
View list✓✓✗
Create/Edit✓✗✗
Deactivate✓✗✗
Groups
View✓✓✗
Create/Edit✓✗✗
Delete✓✗✗
Settings
View✓Limited✗
Modify✓✗✗
Reports
View✓LimitedLimited
Export✓Limited✗
Audit Logs
View✓Own✗
Export✓✗✗

Group-Based Access​

How Groups Affect Access​

Beyond roles, access is refined by group:

  • Agents see requests in their groups
  • Group membership required for queue access
  • Cross-group requires Admin or explicit assignment

Multiple Group Membership​

Users in multiple groups:

  • See requests from all groups
  • Can be assigned from any group
  • Combined queue view

Example​

Agent in "Hardware" and "Network" groups:

  • Sees both queues
  • Can claim from either
  • Assigned requests from both visible

Changing Roles​

Process​

  1. Navigate to Settings > Users
  2. Find user
  3. Edit role assignment
  4. Save changes

Considerations​

  • Takes effect immediately
  • User may need to refresh
  • Audit log entry created
  • Previous actions unchanged

Demotion​

When reducing access:

  • User loses permissions immediately
  • Active sessions may need refresh
  • Historical access preserved in logs

Promotion​

When increasing access:

  • User gains permissions immediately
  • No refresh typically needed
  • Consider training needs

Security Recommendations​

Admin Accounts​

  1. Minimize: Few people as possible
  2. Named: No shared Admin accounts
  3. Monitor: Review Admin actions regularly
  4. MFA: Enable at identity provider

Agent Accounts​

  1. Appropriate scope: Only needed groups
  2. Review regularly: Update with role changes
  3. Train: Ensure understanding of capabilities

Viewer Accounts​

  1. Purposeful: Clear reason for access
  2. Time-limited: Review continued need
  3. Upgrade path: Promote when appropriate

Troubleshooting​

User Can't Perform Action​

  1. Check user's role
  2. Verify action is allowed for role
  3. Check group membership if relevant
  4. Consider if role change needed

Unexpected Access​

  1. Review user's role
  2. Check group memberships
  3. Review any recent changes
  4. Audit log for role changes