Roles and permissions

Result

You have a test user with exactly the key a front-desk assistant needs, created in your sub-account (the practice one or your business's) and tested in a private window.

Estimated time

35 minutes

Cost

US$ 0. Users cost nothing on any plan, and this lesson uses no wallet balance.

Analogy

Step-by-step guide

Menu paths are shown as they appear in the English interface. If your team works with the account in Spanish, the Spanish names are in parentheses; HighLevel leaves some labels in English.

1. 01

   Read your own key from the inside

   Agency View → Settings → Users → (your user) → Edit user → Roles & permissionsCopy path

   In a Spanish-language account: Vista de agencia → Configuración → Usuarios → (tu usuario) → Roles & permissions

   In Agency View, open Settings → Users and click the pencil on your row. Edit user opens, with two tabs on the left: User info and Roles & permissions.

   Open Roles & permissions. User type and User role sit at the top. On your user they're locked to Agency and Admin: you own the building.

   Below, Add sub-accounts lists the units you're assigned to. Next comes the Restrict data visibility to only assigned data switch.

   Then come the cards, one per module, each with its switch and a count: Account Billing 1/1, Account Settings 2/2. The Search perm box jumps straight to a module.

   Open a card: inside are that module's actions.

   You'll also see Transfer ownership. Leave it alone: it hands the building over to someone else.

   Leave with Cancel. You don't change anything on your own user today.

   Key points

   • A key is built in layers, and each layer trims the one before: type, role, sub-accounts, modules and, inside each module, its actions.
   • A module that's off hides everything inside it. What you can turn on depends on the role and on the features the sub-account has.
   • An agency has one owner. Only the owner can transfer ownership, and only to an Agency Admin; the former owner becomes an Agency Admin.
   • HighLevel redesigned this screen in September 2026 and rolls it out through Labs, as User Management – UI Refresh. If you see a long permissions page, or the menu says Team or My Staff, it's the older version: it does the same thing.
   • In a Spanish-language account, the path starts at «Configuración → Usuarios».

   Source: F3, F2, F9, F5

   1TypeAgency: the whole building · Account: only the assigned sub-accounts · Front desk: Account

   2RoleAdmin: administrative access, can be trimmed · User: only what is turned on · Front desk: User

   3Assigned sub-accountsFront desk: only Alba Studio’s

   4ModulesOne switch per module; off hides everything inside · Front desk: Conversations, Calendars and Contacts

   5Actions inside each moduleFront desk: in Contacts, create and edit on; export off

   Restrict data visibility to only assigned dataDecides which records appear inside the open modules · Front desk: off

   Agency View → Settings → Users → Edit user → Roles & permissions

2. 02

   Write the front-desk key

   Before you create anything, write down in a note what a front-desk assistant does at Alba Studio: answers messages, books and moves appointments, and adds and corrects clients.

   Next to each task, write the module that opens it: Conversations, Calendars and Contacts.

   Below, list what stays with you. Account Billing: the sub-account's Billing, with its cards. Account Settings: business details, domains and branding.

   Account Tools: imports and exports. Automation: your workflows. The payment modules, with charges and refunds, and the user permission.

   Close with the key in one line: Account type, User role, only your sub-account, and three modules.

   Key points

   • Account type: enters only the sub-accounts you assign and has no agency access. For someone in a single business, never Agency.
   • User role: gets only the permissions you turn on. An Admin can be trimmed too, but starts from administrative access and can add and edit users at their level.
   • HighLevel recommends giving each user the least access their work requires and reviewing permissions when their tasks change. It's NIST's least-privilege principle.
   • This is the key AXIS recommends for the front desk. If your front desk also takes payments, add only what charging needs and check that refunds stay off.
   • HighLevel's help lists exporting under both Contacts and Account Tools. An export takes your client base out of the account in a file: that's not front-desk work. That's why, in step 3, you turn off export inside Contacts.
   • Payments come in several modules: Payments, Payment Settings, Subscriptions and Transactions. The help lists refunds under both Payments and Transactions. A 2025 payments guide gives refunds their own switch inside Transactions.
   • Creating, editing and deleting users is its own permission, called View & Manage Users in the help. With it off, nobody cuts keys for you.
   • Users cost nothing on any plan. Each person carries their own key; sharing yours never saves anything.

   Source: F1, F2, F3, F4, F12, F15, F19, F20

   On

   ConversationsAnswer messages

   CalendarsBook and move appointments

   ContactsAdd and correct clients

   Stays with you

   Account BillingThe sub-account’s cards

   Account SettingsDetails, domains and branding

   Account ToolsImports and exports

   AutomationYour workflows

   Payments and refundsCharging isn’t front-desk work

   UsersNobody cuts keys for you

   Adjust the list to your front desk’s real tasks

3. 03

   Create the test user

   (your sub-account) → Settings → Users → + Add userCopy path

   In a Spanish-language account: (tu sub-cuenta) → Configuración → Usuarios → + Add user

   Step into your practice sub-account and open Settings → Users. Click + Add user: the Add user wizard opens. If in mission 2 you opened your business sub-account instead of the practice one, do it there: you remove the test user in I.2.3.

   Under User info, type Front Desk in First name and your evidence code in Last name, for example AX-7K2Q. Under Email, use an alias of your address, such as yourname+frontdesk@gmail.com.

   Click Next. Under Roles & permissions, choose the Account type and the User role. Add sub-accounts should hold only your sub-account.

   Check that Restrict data visibility to only assigned data is off. You'll see why below.

   Go through the cards one by one. Turn on Conversations, Calendars and Contacts, and turn every other card off. Don't assume they start off.

   Open the Contacts card and turn off the export action. If import and delete appear as separate actions, turn them off too. Leave create and edit on.

   Leave the Call & voicemail, User availability and Calendar configuration steps as they come. Save at the end.

   Key points

   • A plus-sign alias lands in your same Gmail inbox. HighLevel won't accept two users with the same email, and yours already has a user.
   • HighLevel doesn't say whether it accepts plus-sign aliases. If it rejects yours, use another address of yours that isn't in your agency.
   • When you save, HighLevel emails the user an invitation to join the assigned sub-accounts.
   • The help calls Restrict data visibility to only assigned data Only Assigned Data. It limits the user to their own records: their contacts and conversations, their calendar and appointments, their opportunities.
   • With that switch on, an unassigned contact doesn't show up either. HighLevel customers have asked since 2022 to also see what belongs to nobody, and HighLevel hasn't replied.
   • A front-desk assistant greets every client: for her, leave it off. Use it for a salesperson with their own book of clients, and assign each new contact to them before you turn it on.
   • What a new user starts with on this screen isn't documented. That's why you check every card.
   • For a second front-desk assistant, create her user and use Copy Permissions with the first one as the source. It copies one user's granular permissions at a time, and HighLevel asks you to review them before saving.
   • The help doesn't say whether Copy Permissions also copies the type and sub-accounts: check them yourself.

   Source: F1, F2, F3, F6, F7, F8, F18

4. 04

   Log in as the front-desk assistant

   Open a private browser window (Incognito, in Chrome). Your HighLevel session isn't there.

   In your inbox, open HighLevel's invitation for Front Desk and paste its link into the private window.

   Create the test user's password and log in. If HighLevel asks for a code, it arrives in your same inbox.

   Look at the left menu: it should show what you turned on, such as Conversations, Calendars and Contacts. Settings stays for their profile. If you see Payments or Automation, go back to step 3.

   Open the switcher in the top left. It shows your sub-account's name, and the assistant has no way into Agency View.

   Take your screenshot 2 here. Then close the private window: your normal session is untouched.

   Key points

   • A private window opens HighLevel without your session, the way the assistant would see it on her computer. In your normal window, HighLevel shows you your key, not hers.
   • HighLevel also has Login As, from the profile icon in the top right. Per its December 2025 help article, an agency admin enters a sub-account as one of its users, without their password.
   • It's handy for checking, but whatever you do that way is logged in Audit Logs under the user's name, not yours. And it doesn't prove what the invitation does: that the email arrives and the password works.
   • A module that's off doesn't stop the workflows already running in it. With Automation off, the assistant can't see your workflows, and they keep working.

   Source: F17, F8, F16, F10, F14, F2

5. 05

   Check the key from outside and justify it

   (your sub-account) → Settings → Users → (test user) → Roles & permissionsCopy path

   In a Spanish-language account: (tu sub-cuenta) → Configuración → Usuarios → (usuario de prueba) → Roles & permissions

   Go back to your normal window. In your sub-account, open Settings → Users: Front Desk AX-7K2Q is now on the list.

   Click its pencil and open Roles & permissions. The type, the role, your sub-account and the cards on and off should all show. That's your screenshot 1.

   In Agency View, Settings → Users lists it too. Its Sub-account column should show only your sub-account.

   If Front Desk AX-7K2Q's Personal Calendar appears under Calendars in your sub-account, HighLevel created it when you added the user: leave it for now.

   In your note, write one line for each module you granted, with its reason. For example: Calendars: books and moves appointments.

   Don't delete the test user. In I.2.3 you remove it with the checklist.

   Key points

   • Users you create in a sub-account also show up under the agency's Settings → Users. There you see at a glance which units each person enters.
   • Changing access doesn't mean deleting: you edit the same user's type, sub-accounts, role or permissions.
   • If the assistant also covers your cousin's food truck, add that sub-account to her same user. One person, one user, even across several sub-accounts.
   • Review each key whenever the tasks of the person carrying it change. In I.2.3 you make it a routine, with a review every quarter.

   Source: F1, F2

Interactive

Do you give your front-desk assistant this permission?

This interactive is used inside your AXIS account.

If it breaks

The mistakes that repeat most, and the way out.