Roles and permissions

LealUp has four roles, designed so each person sees only what their daily work needs: admins configure, directors oversee, csms work their book, and viewers look without touching.

This page covers what each role can do, how the menu changes, which screen you land on when you sign in, and how to assign roles.

What a role is in LealUp

A role is a set of permissions per feature and action. It is not configurable through the UI: the rules live in code (backend/app/core/permissions.py) and ship with each release. If you need a custom role, contact support.

The four available roles:

How roles shape what you see

Sidebar

LealUp hides whole sections when your role has access to none of their options. A viewer does not see Settings → Team, because they have no permission over team management. A csm does not see the integration configuration forms, but can see the status of the ones already connected.

When a section loses every item to permission restrictions, it disappears from the menu rather than sitting there empty. That is not a bug: you are seeing exactly what your role allows.

Default screen on sign-in

When you sign in or open your workspace root (/), LealUp takes you to the most useful screen for your role:

You can navigate to any screen you have permission for from the menu, whatever your default is.

Role by role

Admin

What they can do:

• Create, edit and delete companies, contacts, segments and custom fields.
• Configure the health model (dimensions, weights, thresholds).
• Manage the team: invite users, assign roles, administer books.
• Connect and configure integrations (Gmail, WhatsApp, Slack, and so on).
• View and export any workspace data.
• Edit playbooks and automation rules.
• View the audit log and billing.

What they cannot do:

• Change another workspace's configuration. Admins are admins only in their own workspace.
• Delete the workspace itself (that goes through support).

Default screen: / (widget dashboard).

Typical example: Matías, Head of Operations at a Chilean B2B SaaS, configures the workspace over the first 2 weeks, defines the health model, invites 4 CSMs and his boss (director), and leaves everything ready for the team to operate.

Director

What they can do:

• See the whole customer book (every segment, every CSM).
• Configure the health model and segmentation.
• Create and edit playbooks; run any playbook.
• Configure renewals (rules, alerts).
• View and configure analytics and dashboards.
• Export data to CSV.
• See the team and how books are distributed (but not invite users, which is admin).

What they cannot do:

• Edit companies or contacts directly (their assigned CSMs do that).
• Connect new integrations (admins only).
• Manage custom fields (read yes, structure no).

Default screen: /cockpit (the Command Center's prioritized feed).

Typical example: Valentina, CS Director, starts the day on the aggregate picture: how many customers are red, how many renewals in the next 60 days, which playbooks are running. If something catches her eye she drills into the specific customer and coordinates with its owning CSM.

CSM

What they can do:

• View and edit the companies and contacts in their book.
• Log activity (notes, emails, calls, meetings).
• Run playbooks on their customers.
• See their personal dashboard (book, tasks, risks).
• Customize their notification preferences.
• Export their own data (not other CSMs').
• See who owns the connected integrations (without editing them).

What they cannot do:

• See customers outside their assigned book.
• Configure the health model or playbooks (only run them).
• Invite users or change roles.
• Export workspace-wide data (only their own).

Default screen: /cockpit (the Command Center's prioritized feed).

Typical example: Joaquín, a CSM with 40 assigned customers, opens straight onto his prioritized feed each morning. When a customer's health drops he gets a notification; he replies by WhatsApp or email from inside LealUp, leaves a note, and marks the task done.

Viewer

What they can do:

• View companies, contacts, interactions and dashboards (whatever the admin enables).
• View the health model, segments and playbooks (without editing).
• View basic analytics and aggregate metrics.

What they cannot do:

• Edit any data.
• Export.
• View the audit log or team configuration.
• Create tasks, send messages or run playbooks.

Default screen: /customers.

Typical example: Cristóbal, VP Sales at the same company, wants to see the renewal pipeline and how the Enterprise accounts are doing without being able to move data. He signs in as a viewer, reviews the metrics, starts a conversation with his counterpart in CS, and leaves.

How to assign a role

Role assignment happens under Settings → Team. Only an admin can change someone else's role.

Two ways:

1. When inviting a new user: pick the role in the invitation dialog. They get an email with a link to your workspace subdomain and accept.
2. For an existing user: in the team list, open the user's ••• menu and choose Change role. The change is immediate; they see the new menu on their next request.

For more on inviting users and the audit log, see Team and roles.

FAQ

Can I hold several roles at once? No. Each user has one role per workspace. If you need to widen a CSM's permissions temporarily, change them to director (or admin) deliberately and change it back afterwards.

Can I create a new role (say "CSM Lead")? Not today. The 4 roles cover the great majority of observed cases. If your organization needs more granularity, write to us and we will talk it through.

Can a director edit customers if the book is assigned to them? No. Permission is evaluated by role, not by ownership. A director has cross-cutting read access and global configuration; to intervene on a customer, assign the action to its owning CSM.

How do I see exactly what permissions a role has? The full feature × action matrix per role is on the Team and roles page. The source of truth is the backend code (backend/app/core/permissions.py), updated with each release.

---

Last updated: 2026-04-21.