Agent Roles and Permissions
What this domain covers
Agent Roles and Permissions tests how Freshdesk separates what an agent can do (role permissions) from which tickets an agent can see (ticket scope, usually group-based). The exam expects you to design least-privilege access without breaking routing.
Core rules and concepts
- Default roles typically include Account Admin, Supervisor, Agent, and Occasional Agent; higher plans add custom roles. A role is a permission template, not a group membership.
- Ticket scope is set per role: Global sees all tickets, Group sees tickets in groups the agent belongs to, and Restricted sees only tickets assigned to that agent. Scope is enforced even if the agent knows a ticket ID.
- Permissions cover ticket actions, contacts and companies, reports, knowledge base, forums, workflows, SLA, integrations, API keys, and audit log. Distinguish view from manage: read access to reports is not permission to edit SLA policies.
- Role and group combine: the role grants capability, while group membership grants visibility for Group scope. Adding an agent to a group does not grant extra permissions.
- Occasional Agents consume limited seats and generally see only tickets assigned to them; they are not a substitute for a full agent when routing needs group visibility.
- API keys inherit the permissions of the agent who created them, so a restricted agent’s key is not an admin key.
Worked example
A billing team needs to see only billing tickets, reply to customers, and read reports, but must not change SLA policies. The admin creates a custom role with Restricted ticket scope, ticket reply and edit permissions, and report view permission, then adds each agent to the Billing group. If the role were left at Global scope, the agents would see every ticket in the account even though they only work billing. The reasoning: scope controls visibility, permissions control actions, and both must be set deliberately.
Traps that cost marks
- Assuming group membership alone grants ticket visibility or admin rights.
- Giving Global scope to a specialist team and calling it a permission fix.
- Forgetting that API keys carry the creating agent’s access.
- Deleting a custom role that agents still depend on, or leaving orphaned elevated roles.
- Confusing the Supervisor role with Supervisor automation rules; they are different features.