Freshdesk Agent Roles

Every Freshdesk agent carries two independent permission settings. Almost every permissions problem I have watched a team argue about comes from treating them as a single dial.

Role is the verb list. Reply, edit, delete, merge, export, edit automations, manage billing. It's a bundle of privileges you attach to a person.

Scope is the noun list. All tickets in the account, only tickets belonging to their groups, or only tickets assigned to them personally. Scope has nothing to do with role. An agent can hold a powerful role and still see almost nothing, and a junior agent on the weakest role can be handed visibility of every ticket in the business.

Set both. Deliberately. On purpose. The default combination is fine for a five-person team and wrong for a fifty-person one.

Three options, and the middle one is right far more often than either extreme.

Restricted sounds tidy and behaves badly. An agent on restricted scope cannot see the ticket a colleague is already answering, cannot pick up the unassigned queue, and cannot check whether the customer in front of them wrote in yesterday about the same thing. That last one costs you real money, because two agents answering the same customer independently is how a support team produces contradictory answers.

Use restricted for outsourced contractors and for people who genuinely should not read other customers' conversations. Not as a general tidiness measure.

Least privilege gets a bad name because people implement it as a lockdown and then spend six months unlocking things one panicked Slack message at a time. Do it the other way round.

Start from what the job needs on a normal day, then add the exceptions someone actually asked for.

A recipe that holds up for a team of ten to fifty. Two account administrators, one of whom isn't the person most likely to be on holiday. Two or three administrators who can change configuration. Team leads on supervisor with global scope, because they need to answer "where is that ticket". Everyone else on agent with group scope.

Then the three specific removals worth making early. Take delete away from everyone except administrators. Take export away from anyone without a business reason, because a full ticket export is a customer data file walking out of the building. And keep automation editing to the people who understand what a rule loop does.