In Cornerspot, a role is a named bundle of rights, and every teammate is assigned exactly one. Your team starts with three ready-made roles, and you can build as many of your own as you need. This guide covers what rights are, where roles live, how to create a custom role, and the guardrails that keep your team from locking itself out.
Where rights and roles live
Open Settings and choose Rights & Roles (at /dashboard/settings/rights-roles). The tile only appears for teammates whose role lets them read roles, so if you can't see it, ask an admin.
Rights are the vocabulary
A right is permission to do one specific thing, such as view contacts or publish a knowledge base article. Cornerspot ships a fixed catalog of rights, grouped into areas like CRM, Commerce & Billing, Forms, Live Chat, and Administration.
Most rights come in pairs. A read right lets someone see a kind of record; the matching write right lets them create, change, and delete it. Granting contacts_read without contacts_write gives a teammate a view-only CRM.
These are the same rights you attach to a consumer API key, so a role and an integration are described in exactly the same vocabulary.
The three roles every team starts with
Each new team is seeded with three roles. You can rename them and adjust what Manager and Rep may do, but you cannot delete them.
- Admin holds every right, and always will. Cornerspot keeps this role complete as new rights ship, so an admin can never be locked out of a new feature. Its rights can't be edited.
- Manager can read and write everything in the day-to-day working area, but reaches none of the administration settings: no team members, no roles, no API keys, no audit log, no automations.
- Rep can read everything, and additionally has full write access to live chat and support tickets. A Rep works the inbox and the ticket queue, but does not edit your CRM records.
Creating a custom role
When none of the seeded roles fits, build your own. Click New Role to open the role editor.
- Give the role a name, and a description explaining what it is for.
- Pick its rights. They are grouped by area, and each group has a checkbox that selects the whole group at once. Use Filter rights to narrow the list, or Select all reads to start from a view-only role and add writes from there.
- Click Create role. A role needs a name and at least one right before it can be saved.
The new role appears in the list with the number of rights it grants and the number of teammates using it.
Assigning a role
Roles are handed out on the Team Members page (at /dashboard/settings/team-members). Open a teammate and pick from the Role dropdown, which lists your custom roles right alongside Admin, Manager, and Rep. The same picker appears when you invite someone.
A teammate only ever sees the parts of Cornerspot their rights allow. Settings tiles and menu entries they can't use simply don't render, and an action beyond their rights is refused by the server, not merely hidden.
What makes a role administrative
Administrator is not a rank in Cornerspot. It is a shape. A role is administrative when it grants both of these rights:
- Manage team members, the right to invite, change, and remove teammates.
- Manage roles, the right to create and edit roles themselves.
Any role granting both is administrative and is marked with an Admin badge in the list, including a custom one you built yourself. Together those two rights let someone hand out any other right, which is why they define the boundary.
Guardrails that keep your team safe
Because administrative access is what protects everything else, Cornerspot refuses changes that would leave nobody in charge.
- Your team keeps at least one administrative member. The last one can't be demoted, suspended, or removed.
- The owner is protected. One teammate owns the team, marked with a crown. The owner can't be moved to a non-administrative role, suspended, or revoked. To hand the team over, use Transfer ownership, which promotes another administrative teammate and leaves you as a regular member.
- You can't change your own role. This keeps you from removing the access you are currently relying on.
- Seeded roles can't be deleted, and the Admin role can't have rights taken away from it.
- A role in use can't be deleted outright. Move its members to another role first, which the editor offers to do for you.
Tips for designing roles
- Grant the least access someone needs. You can always add rights later.
- Start from Select all reads, then add only the writes that role genuinely performs.
- Name roles after the job, not the person, so "Support Lead" outlives whoever holds it.
- Keep more than one administrative teammate, so you never depend on a single person for access.
- Grant the two administrative rights deliberately. Any role holding both can hand out every other right.