> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles

> Four roles on one axis, and what each is deliberately kept away from.

FireTone has four roles. Each is a bundle of named permissions, and they sit on
a single ladder — but the interesting part of each is what it is kept *away*
from, not what it adds.

## Agent

The floor. Reads their own work and places their own calls: call history, the
directory, their queues, contacts and tickets read-only, voicemail, and the
controls to make and hold a call.

**Excluded on purpose:** billing and trunks. An agent has no reason to see what
a call cost or which carrier carried it, and both are a tenant's commercial
position rather than a person's job.

**Their lists are their own work**, not the tenant's: call history,
dispositions, conversations and stages are narrowed to the agent, not merely
filtered in the interface. A supervisor sees their team; an agent sees
themselves.

Call control is in the [phone panel](/agent/the-phone) beside every page —
answer, hold, transfer, park and conference — and it acts on whichever call the
switch says is theirs, browser or desk phone.

## Team supervisor

An agent plus oversight — and the oversight comes from **scope**, not extra
powers. A supervisor sees their own teams' work rather than a wider slice of the
menu.

Adds: listening to recordings, rostering queues, writing contacts and tickets,
reading satisfaction scores, and **reading** campaigns and processes.

**Excluded on purpose:** starting, stopping or re-targeting a campaign. A
supervisor can see what is running and cannot change what it does.

## Organisation admin

Runs one tenant. Everything above plus the organisation itself, teams,
extensions, agents, IVR flows, routing, users, API keys, AI configuration,
campaigns, processes, and reading their own bill.

**Excluded on purpose:** trunks, nodes, rate writes — the operator's
infrastructure — and **margin**. A tenant sees what they are charged; what the
operator paid underneath it is not theirs.

## Operator admin

Owns the platform. Every permission there is.

***

## How this shows up

<Note>
  Every route the API serves declares a permission, and a test fails the build
  if one does not. The panel hides screens you have no grant for, but the hiding
  is a courtesy — the API is what actually refuses.
</Note>

Two consequences worth knowing:

* **An API key can never exceed its owner.** A key's permissions are intersected
  with the role of the person who created it. Granting a key something you do
  not have yourself is not possible.
* **An unattributed record is invisible to a restricted reader.** Where FireTone
  cannot demonstrate a row is yours, it does not show it. "Cannot prove it is
  yours" resolves to no, not to yes.