Skip to main content

Roles & Permissions

Naturalead uses Role-Based Access Control (RBAC) with 5 roles and 33 permissions across 12 domains.

Roles

RoleDescriptionUse Case
OwnerFull access to all resources and settingsAccount administrators
IntegratorIntegration setup, API key management, audit accessDevOps and integration engineers
AI ArchitectAgent configuration, knowledge base management, A/B testingAI/ML team members
OperatorLead management, conversations, campaigns, analyticsSales and operations teams
AnalystRead-only access across most domainsReporting and business analysts

Permissions matrix

Dashboard

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
dashboard:viewYesYesYesYesYes

Leads

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
leads:viewYes--YesYes
leads:importYes--Yes-
leads:start_conversationYes--Yes-
leads:sync_createYesYes---
leads:sync_deleteYes----

Conversations

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
conversations:viewYes-YesYesYes
conversations:editYes--Yes-
conversations:send_messageYes--Yes-
conversations:change_statusYes--Yes-

Agent Config

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
agent_config:viewYes-Yes-Yes
agent_config:editYes-Yes--

Knowledge Base

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
knowledge:viewYes-Yes-Yes
knowledge:uploadYes-Yes--
knowledge:deleteYes-Yes--

Campaigns

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
campaigns:viewYes--YesYes
campaigns:createYes--Yes-
campaigns:editYes--Yes-
campaigns:launchYes--Yes-
campaigns:deleteYes----

Analytics

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
analytics:viewYes--YesYes

Integrations

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
integrations:viewYesYes---
integrations:editYesYes---
integrations:testYesYes---
integrations:provisionYesYes---

A/B Testing

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
ab_testing:viewYes-Yes-Yes
ab_testing:manageYes-Yes--

API Keys

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
api_keys:viewYesYes---
api_keys:manageYes----

Audit

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
audit:viewYesYes--Yes
audit:exportYes----

Team & Account

PermissionOwnerIntegratorAI ArchitectOperatorAnalyst
team:viewYesYesYesYesYes
team:inviteYes----
team:removeYes----
team:change_roleYes----
account:viewYesYesYesYesYes
account:editYes----

API key scope restrictions

When creating an API key, you can only assign scopes that your role has permission for:
  • An Operator can create a key with leads:view, leads:import, campaigns:view, etc.
  • An Operator cannot create a key with integrations:edit (they don’t have that permission).
  • Only the Owner role can grant all scopes.
This prevents privilege escalation through API key creation.

Default role

New members added to an account are assigned the Owner role by default. Account owners can change member roles via Settings > Team.