Ticketing
Support platform access
Plan support platform access by role, case visibility, temporary work and integration permissions, with checks for each grant.
Support platform access should match what a person or integration needs to do: which cases it sees, which actions it takes and when access ends. Set case visibility separately from role permissions, then check the result in the account and plan you use.
Record each grant
Keep a short register for staff and connected applications:
Decision / Record
- Purpose
- The support task and the person responsible for it
- Visibility
- The queues, cases, notes, attachments and customer records needed
- Actions
- Whether access includes replying, editing, exporting, reassigning or changing settings
- Duration
- The review date and the event that ends access
These are planning questions; platforms offer different controls. For Australian organisations covered by the Australian Privacy Principles, the OAIC publishes information security guidance, including Chapter 11 on APP 11. A platform role is only one part of that work.
Keep account ownership covered
Freshdesk distinguishes an Account Administrator from an Administrator. The Account Administrator can access billing and account management settings, and at least one Account Administrator must exist at all times. Freshdesk recommends configuring an Account Administrator as a full-time agent so portal access remains available.
A Freshdesk Day Pass lasts until 23:59 and does not carry over to the next calendar date. The end of day is calculated using the helpdesk’s time zone on Growth plans and the agent’s time zone on Pro plans. This is a licensing limit, not a substitute for an access end date.
Distinguish platform permissions from privacy access
For an APP entity, the APP privacy policy must explain how an individual can access personal information held about them and seek its correction. It must also describe the kinds of personal information collected and held, how it is handled, and the purposes for which it is used or disclosed. These privacy processes are separate from an employee’s platform permissions.
Key Access Control Requirements for Australian Organisations
- APP ComplianceRequired under Australian Privacy Principles (APP)
- Security GuidanceChapter 11 of OAIC Guidelines on APP 11 – Security of Personal Information
- Privacy Policy ObligationsMust explain access, correction, collection, handling and use of personal information
Separate actions from visibility
An agent may need to reply to assigned cases without seeing every queue. A supervisor may need to review a team’s cases without changing account settings. An administrator may need to manage access without handling customer replies.
Freshdesk documents roles for permitted actions and a separate ticket scope for visibility. Zendesk’s eligible plans offer custom agent roles with ticket permissions. Check the configured permissions rather than relying on a job title.
Give sensitive cases a boundary
Decide where a case containing, for example, an identity document or security report enters, who handles it and who can still see it after reassignment. Review participants, notes, notifications, reports and integrations as well as the queue view.
Zendesk private ticket groups are an Enterprise feature that restrict ticket access to group members, with exceptions based on agent roles.
End temporary access deliberately
Before granting a contractor access, agree on their queue, tasks, supervisor and end date. Give them an individual account. Before departure, reassign unfinished cases and review platform, mailbox, identity-provider and separately authorised app access.
Freshdesk’s occasional-agent day passes are consumed when an occasional agent logs into the portal and are valid until the end of the day. Zendesk recommends reassigning an agent’s open tickets before removal.
Freshdesk vs Zendesk: Temporary Access Controls
- Freshdesk Occasional Agent Day PassValid until end of day (23:59), consumed on login. Time zone depends on plan (Growth: helpdesk; Pro: agent).
- Zendesk Reassignment RequirementRecommended to reassign open tickets before removing an agent.
Review integrations as access grants
List each integration’s owner, authorising identity, scopes, data retrieved, stored copies and revocation path.
For any proposed role or integration, use safe sample cases to check expected access through ticket opening, search and relevant notifications. Repeat the review after changes to roles, groups or connections. Record the outcome in the access register.
In this guide
- Separating agent, supervisor and administrator permissionsUse a task-based matrix to separate support agent, supervisor and administrator actions, then check ticket visibility and exceptions.
- Restricting access to sensitive customer casesDesign a restricted case workflow and check roles, participants, reports, requester access and connected applications.
- Managing contractor access to a support queueDefine a contractor's support queue access, distinguish day passes from account expiry and hand over open cases before removal.
- Reviewing what a support integration can readAudit a support integration's scopes, authorising identity, retrieved records, stored copies and revocation path.
