# Roles & permissions > The account roles and the Connect and Apps permissions, where an admin sets them, and which access levels each plan allows. Canonical HTML page: https://conclude.io/doc/admin/users-and-access/roles-and-permissions/ Last updated: 2026-11-02 --- Conclude has one set of account-wide roles and a small set of permissions. You manage all of them on one page, [**Admin console > Users and access > Roles & permissions**](https://conclude.io/admin/roles). This page is for account owners and account admins. App roles are different. They govern tickets inside one app, and the [Roles tab](https://conclude.io/doc/apps/editor/roles/) covers them. The page has three sections: **Account**, **Connect** and **Apps**. Only the account owner and account admins can open it. A billing admin sees only the **Account** and **Billing** pages in the Admin console. Members cannot open the page at all. Rows under Connect and Apps appear only for the capabilities that are enabled on the account. ## Account roles The **Account** section assigns the roles that administer the whole account. An account has exactly one owner. It can have any number of account admins and at most one billing admin. | Role | What it grants | |---|---| | **Account owner** | Full control of the account, including ownership transfer. | | **Account admins** | Full admin access across settings, connections, apps and users. | | **Billing admin** | Can view invoices and manage subscription and payment details. See [Billing](https://conclude.io/doc/admin/organization/billing/). | Everyone else is a member. The permissions below decide what a member can do beyond taking part. The account owner and account admins always have every permission. ## Access levels Each permission in the Connect and Apps sections has one of three access levels. The plan decides which levels you can choose. | Access level | Who gets access | Selectable on | |---|---|---| | **Admins** | Account owner and account admins only | Pro, Enterprise | | **Everyone** | All active users in the workspace | Pro, Enterprise | | **Admins + specific users** | Admins plus individually chosen users, without full admin rights | Enterprise, and during the trial | On Starter, the **Manage** button is disabled. A tooltip says that a Pro or Enterprise license is required, so you cannot change the current level. On Pro, **Admins + specific users** is shown but disabled, with a tooltip about Enterprise. See [Pricing](https://conclude.io/pricing/) for the plans and [Billing](https://conclude.io/doc/admin/organization/billing/) for your subscription. To change a permission: 1. Open [**Admin console > Users and access > Roles & permissions**](https://conclude.io/admin/roles). 2. Click **Manage** next to the permission. 3. Select **Admins**, **Admins + specific users** or **Everyone**. 4. For **Admins + specific users**, search for and add the users. 5. Click **Save**. ## Connect permissions The **Connect** section controls who may create connections and chats. Conclude shows **Connect channels** and **Create chats** only when Connect is enabled on the account. It shows **Connect external channels** only when External is enabled. **Manage bridges** appears only when Bridge is enabled. | Permission | What it allows | |---|---| | **Connect channels** | Connect channels between your own workspaces ([Internal](https://conclude.io/doc/connect/internal/)). | | **Create chats** | Create direct chats between users across your connected workspaces ([Chats](https://conclude.io/doc/guides/chats/)). | | **Connect external channels** | Connect channels with other organizations ([External](https://conclude.io/doc/connect/external/)). | | **Manage bridges** | Manage bridges between organizations ([Bridge](https://conclude.io/doc/connect/bridge/)). | **Connect external channels** decides who may start a connection. Even at **Everyone**, the other organization must accept the invitation before the connection becomes active. ## App permissions The **Apps** section has a single permission, **Manage apps**. It covers: * Installing apps and integrations from Conclude's templates * Uninstalling apps * Configuring app settings and permissions Built-in templates and third-party integrations such as Jira and Zendesk all count as apps here. See [Templates](https://conclude.io/doc/apps/templates/) and [Integrations](https://conclude.io/doc/apps/integrations/). **Manage apps** decides who may install and configure apps. Each app then decides who does what inside it. The [Roles tab](https://conclude.io/doc/apps/editor/roles/) sets the default assignee, who is invited to each ticket, where alerts go and who may create tickets. You set `admins` and `superusers` in the app's YAML `roles` block. See [Macros and roles](https://conclude.io/doc/reference/macros-and-roles/#roles-block). App roles are separate from account roles, and an app admin is not an account admin. **Accounts with external connections.** If your workspace has external connections, keep **Manage apps** at **Admins** or **Admins + specific users**. Then nobody changes an app in a shared channel by accident. ## Where each role lives | Role family | Scope | Defined in | |---|---|---| | Account owner, account admins, billing admin | Whole account | [**Admin console > Users and access > Roles & permissions > Account**](https://conclude.io/admin/roles) | | Connect permissions | Creating connections, chats and bridges | [**Admin console > Users and access > Roles & permissions > Connect**](https://conclude.io/admin/roles) | | Manage apps | Installing and configuring apps | [**Admin console > Users and access > Roles & permissions > Apps**](https://conclude.io/admin/roles) | | App roles (owner, members, admins, superusers) | One app and its tickets | The app's [Roles tab](https://conclude.io/doc/apps/editor/roles/) and YAML `roles` block | Related: [Organization](https://conclude.io/doc/admin/organization/), [Permissions in Slack](https://conclude.io/doc/admin/reference/permissions-slack/), [Permissions in Microsoft Teams](https://conclude.io/doc/admin/reference/permissions-microsoft-teams/).