Users & Roles
Manage user access with workspace, application, and agent-level permissions
Helvia gives you fine-grained control over what every team member can access. Permissions operate on three independent layers: workspace roles set Workspace-wide privileges, application roles unlock dedicated tools like LiveChat, and agent-level roles let you configure access per agent. You can invite users, assign roles, and organize teams into groups, all from a single section in Workspace.
Go to Workspace > Users to manage your team.
Understanding the Role System
Permissions in Helvia operate on three independent layers. Each layer controls a different scope of access, and they are configured independently of each other.
Workspace Access Roles
These roles govern what a user can see and do at the Workspace level. Every user is assigned exactly one workspace role, and they are mutually exclusive. A user with No Workspace access can only interact with agents they have been explicitly granted access to.
View Workspace settings
✅
✅
✅
View Knowledge Bases
✅
✅
✅
Upload new media
✅
✅
✅
View Audit Logs
❌
✅
✅
Create and edit Knowledge Bases
❌
✅
✅
Manage integrations
❌
✅
✅
Delete media
❌
❌
✅
Invite users
❌
❌
✅
Manage users and user groups
❌
❌
✅
Change Workspace settings
❌
❌
✅
Each user can hold exactly one workspace role. You select it when managing a user or sending an invitation.
Application Roles
Application roles unlock access to LiveChat as a separate application alongside Workspace, Designer, and Observatory. Unlike workspace roles, these are additive: a user can hold both, one, or neither. Once assigned, the LiveChat view appears for that user.
Handle live conversations
✅
✅
Configure personal settings
✅
✅
Create and manage canned responses
❌
✅
Download transcripts in bulk
❌
✅
Manage global LiveChat settings
❌
✅
Access the Admin Panel
❌
✅
For a full walkthrough of the LiveChat application, see LiveChat.
Agent-Level Roles
Not every team member needs the same access to every agent. Agent-level roles let you set permissions independently for each agent a user can reach.
View workflows, settings, and deployments
✅
✅
✅
Edit workflows, settings, and deployments
❌
✅
✅
Publish agent versions
❌
✅
✅
Delete workflows or the agent
❌
❌
✅
Manage user access to the agent
❌
❌
✅
Workspace admins automatically have access to all agents. Users with No Workspace access can still access agents they have been explicitly assigned to.
Managing Users
The Workspace > Users hub gives you an overview of everyone in your Workspace. From here you can see each user's information like name and email and their access roles. Use the search bar to find a specific user, or select multiple users with the checkboxes to perform bulk actions.
Editing a User
Assign to User Groups
Add the user to one or more groups. Any permissions defined at the group level apply automatically.
Removing a User
To remove a user from your Workspace, open the Users tab and use the delete action . This revokes all access and removes them from any groups they belong to.
Removing a user is permanent. The user will lose access to all agents and Workspace resources immediately.
Inviting New Users
New Workspace members join through email invitations. You configure their initial permissions at the time of invitation, and they complete registration through the link they receive. The invitation link expires after 7 days.
Sending an Invitation
The invitation requires at least some level of access. Assign a workspace role, an application role, or agent access before sending.
Tracking Invitations
The User Invitations hub tracks every invitation sent from your Workspace. Here you can see who was invited, what access they were given, whether they accepted, and when the invitation expires.
Invitations have four possible statuses:
The user has registered and is now an active member of your team. Their profile appears in the Users tab, where you can edit their permissions.
The invitation has been sent and is waiting for the user to accept. You can revoke a pending invitation using the action on the row.
The invitation was manually revoked before the user could accept. Send a new invitation if access is needed again.
The invitation link has passed its expiration date without being used. Send a new invitation if the user still needs access.
Filter by status to find pending or expired invitations, or search by email to locate a specific one.
User Groups
Managing permissions for individual users works well for small teams, but becomes tedious as your team scales. User groups let you bundle users together and assign workspace roles, application roles, and agent access at the group level. When you update a group's permissions, every member inherits the change.
Group roles override individual user roles. When a user belongs to a group, the group's roles take effect regardless of what was set on the user directly. If the user is removed from the group, the original roles apply again.
Best Practices
Audit regularly: Review the Users tab periodically to deactivate accounts that are no longer needed and verify that roles still match responsibilities
Separate workspace and agent roles intentionally: A user can be a Workspace viewer but an agent Admin. Use this to let specialists manage their own agents without touching Workspace settings
Set agent access during invitation: Configuring permissions upfront means the new user can start working immediately after accepting, with no follow-up editing required
Name groups descriptively: "QA Team" or "Tier 2 Support" communicates purpose at a glance. Avoid generic names like "Group 1"
You now know how to manage users, configure roles at every level, invite new team members, and organize your team with user groups.
Last updated
Was this helpful?