Ticketing
Part of Support platform access
Separating agent, supervisor and administrator permissions
Use a task-based matrix to separate support agent, supervisor and administrator actions, then check ticket visibility and exceptions.
Give agents the actions to handle cases, supervisors the actions to review and coordinate work, and administrators the settings to manage. Set ticket visibility separately: a role with few editing rights can still expose too many customer cases.
Start with tasks, then choose roles
Use a task matrix before assigning a platform role:
| Task | Agent | Supervisor | Administrator |
|---|---|---|---|
| Reply to a customer case | For assigned work | When covering the queue | Only if support work is part of the role |
| Reassign team work | When needed for handover | For supervised work | Only if operational coverage is needed |
| Review team cases and workload | For their own work | For the teams supervised | Only when needed for administration |
| Change roles or account settings | No | Only a specifically delegated setting | For authorised administrators |
This is a decision aid, not a vendor default. Record who approves exceptions and when they end. If a supervisor also handles tickets, specify both responsibilities rather than assuming a title supplies the right permissions.
Steps to Assign Roles Based on Tasks
- Identify core tasks by roleUse the task matrix to map responsibilities
- Choose platform role based on tasksMatch actions to Freshdesk or Zendesk default roles
- Check ticket visibility scopeConfirm assigned, group, and tagged ticket access
- Test with sample casesValidate access to normal and boundary cases
- Record approvals and review schedulesTrack exceptions and set renewal dates
Check the whole permission assignment
Freshdesk separates roles, which govern actions, from ticket scope, which governs visibility. Its default Agent role can view, respond to, assign and update tickets. Its Supervisor role can manage tickets, generate reports and configure automatic ticket assignment for groups. Its Administrator role can configure Admin settings but cannot access billing; Account Administrator includes billing and account management.
Freshdesk documents all-ticket, group-ticket and assigned-ticket scopes. The assigned-ticket scope can also include tickets where the person is tagged or has secondary ownership. Check those paths before treating it as an assigned-only boundary. Freshdesk's admin guide describes roles and scope; confirm the features available in the account, especially where an older or Omni setup differs.
Zendesk offers custom agent roles on eligible plans. Its documented Staff starting role can edit tickets within its groups; Team lead can read and edit all tickets. Custom roles offer ticket access and editing choices, so inspect the configured role rather than assigning access by job title.
Check a normal case and a boundary case
For each proposed role, have an authorised account owner check safe sample cases: one assigned, one in another team and one restricted. Record whether the person can find, open, reply to and reassign each case, and whether they can change relevant settings. Include search and notifications when they form part of the workflow.
Review the matrix after a change in duties or group membership. Remove permissions that no longer serve the person's work.
Verify Permissions After Role Assignment
- Check access to a normal (assigned) caseCan find, open, reply to and reassign?
- Check access to a boundary case (in another team)Can find, open, reply to and reassign?
- Check access to a restricted caseCan find, open, reply to and reassign?
- Review search and notification accessIncluded in workflow?
- Document exceptions and expiry datesRecord who approved and when it ends
- Review after duty or group changesRemove outdated permissions
