Users, roles and permissions

The two roles: User and Admin

Every person in Zuzana has one of two roles, User or Admin. The role decides which parts of the app they can open. It does not decide which conversations they see: that is what capabilities do.

A User works in the helpdesk only. Their sidebar holds the conversation views, their personal Settings (theme, language, timezone, signature display), their profile and, if granted, Macros. A link to any other page, such as the Dashboard, an article or Settings, sends a User back to the helpdesk without an error.

An Admin has full access, Billing included. Inside the helpdesk, Admins and Users work exactly the same way.

Letting a User manage macros

There is exactly one permission you can give a User without making them an Admin: Manage Macros. It lets them create, edit and delete the team's macros and their translations.

1. Go to Settings → Users and click the person.
2. Open the Permissions tab and tick Manage Macros under Settings Access.
3. Press Save Changes.

The User then finds a Macros link ⚡ at the bottom left of the helpdesk sidebar, just below Settings. It opens the macro list, and Home takes them back. Reload the helpdesk once if the link is missing.

• Per brand 🏷 The permission belongs to the brand where you ticked it. The link only shows while the person works in that brand, so tick it in every brand where they should manage macros.
• Macros only 🔒 It does not unlock Variables. A User can use existing variables in a macro but not create or change them.
• Users only The Permissions tab only exists for Users. Admins already have everything.

There is no permission for Articles, Policies, Workflows or any other knowledge page. If someone should help improve what the AI knows, make them an Admin. Otherwise, have them send suggestions to an Admin.

Role versus capabilities

The role decides what someone can do and which pages they can open. Capabilities (access rules on markets, channels and tags) decide which conversations they see, are served and can be assigned. An Admin with a strict Denmark-only rule still only gets Danish tickets in their queues and flow, and a User with no rules sees the whole board. See Capabilities.

Managing people on the Users page

Admins manage everyone under Settings → Users (the User Management page). Only Active people are listed at first: set the User Status filter to Deactivated to see the rest. Open invitations are listed below the people, under Invitations.

Click a person to open them:

• General 👤 Name, email, Role and Squads. The email is what they sign in with, so when someone's work address changes, edit it here instead of inviting the new address.
• Capabilities 🎚 Attach shared rules with Add capability, or give them a private rule with Edit custom rule. These save straight away.
• Permissions 🔑 Users only, see above.
• Advanced 🛠 Deactivate or reactivate the account.

Note: a person has one role everywhere. If they belong to several brands, changing their role, name or email in one brand changes it in all of them.

Deactivating and reactivating someone

When someone leaves, open them under Settings → Users, go to Advanced and press Deactivate user.

• Signed out at once 🚪 Every session ends, on every browser and device, and they can no longer request a sign-in link.
• Out of routing They are no longer served conversations and disappear from assignee lists and agent filters.
• Their tickets stay with them 📌 Nothing is handed on automatically. Reassign their open tickets before you deactivate, while you can still filter the board by their name.
• Every brand 🌐 Deactivation applies to the person, so they lose access to all your brands, not just this one. Their history on tickets stays.

To bring someone back, set the filter to Deactivated, open them and press Reactivate user. Squads, capabilities and brands are as they left them, and they sign in with a new magic link. No new invitation is needed.

There is no button to remove someone from one brand while keeping them in another. Contact us if you need that.

Inviting again: existing people and expired invitations

Sending an invitation is covered in Inviting your team. These cases on Settings → Users trip people up:

• "This user is already a member of your team." They already have access. If they cannot get in, they are probably deactivated: find them with the Deactivated filter and reactivate them. If they are active, they just sign in with their email address.
• "This email already has a pending invitation for this team." Resend the waiting one from Invitations.
• Expired ⏳ An invitation lasts seven days. Resend is only offered while it is still pending, and gives it seven new days. Once it has expired, press Invite User again for the same address and Cancel the old row.
• Already uses Zuzana 🔁 The link adds them at once and they keep the role they already have. The role in the invitation only applies to new accounts.
• One at a time The form takes one email and a role. There is no bulk invite, and you cannot set name, squads or capabilities in advance: the person types their own name, and you set the rest once they appear in the list.

Your name, alias and job title

Each person sets their own details: click your name at the bottom of the helpdesk sidebar to open Profile, with Avatar, Full name, Public Alias and Job title. An Admin can change someone's full name on their user page, but the alias and job title belong to the person.

• Email ✉️ The signature and From name are set once for the team under Settings → E-mail, tab Email Signature. {{agentName}} becomes your public alias if you have one, otherwise your full name, and {{agentJobTitle}} your job title. If the team has no signature, the email body carries no agent name, so an alias has nowhere to show.
• Chat 💬 The widget shows only your first name (the first word of your full name) on your messages and in the header. The alias is not used there.
• Social and SMS signatures use the same merge tags as email.

First names only? There is no team-wide switch. Chat already does it. For email, have each person set their Public Alias to their first name, and check that the signature or From name uses {{agentName}}.

Going online needs a market you cover

To take live chats and calls you go online from the status button in the helpdesk top bar, in Where are you available?: one row per market, one column each for Chat and Voice. Email has no online switch.

The grid only shows markets and live channels your access rules allow. Your own rules and your squads' rules count when they are strict or routing. A preference rule never adds a cell. If nothing is left, the panel says No markets configured yet for this team, even when the team has markets. It nearly always means the person's rules cover no market on Chat or Phone.

The fix: give them, or one of their squads, a strict or routing rule that includes the market and Phone or Chat (or leave channels empty for all). A person with no rules at all can go online everywhere.

Signing in

Zuzana has no passwords. Enter your email on the sign-in page and press Send Magic Link. The email's Sign in now button opens Confirm sign in: press Sign In. Zuzana then keeps you signed in on that browser.

• 15 minutes ⏱ The link expires 15 minutes after it is sent, and it works once.
• Newest link only Asking for a new link cancels any earlier unused one, so open the latest email.
• "No account found with this email address." They have not accepted their invitation yet, or use another address.
• "This account has been deactivated." An Admin must reactivate them.

There is no Google or Microsoft sign-in, no single sign-on (SSO) and no two-factor authentication. Desktop app: press Sign in with Browser, sign in with a magic link there, then press Approve Sign In.

Working across several brands

Each brand is its own team, and membership is per brand: you see a brand's tickets only if you are a member of it.

• Team switcher 🏢 At the bottom of the helpdesk sidebar. It only appears once you belong to more than one brand.
• All teams 🌐 If your brands form a workspace and you are a member of it, the switcher offers All teams (or each workspace by name, if you are in several), one board for all your brands.
• My Conversations shows one brand The whole board, counts included, follows the switcher. Pick All teams to see all your brands at once. No All teams option means you are not in the workspace.
• New colleague missing when assigning 👥 The assignee list holds active members of the ticket's own brand. People appear once they have accepted their invitation, and only on brands they belong to.

Access to another brand: an Admin of that brand invites them from that brand's Settings → Users. For every brand at once plus All teams, they must join the workspace, which we set up: contact us when new people start, because an invitation to one brand does not add anyone to the workspace. Users and invitations are managed per brand; there is no combined list across brands.

Good to know

• A role change applies on the person's next page load. Changing someone from Admin to User? Save first, then the Permissions tab appears.
• Settings in the helpdesk sidebar is your personal preferences, not the team's Settings area.
• If your workspace is set up so access rules must cover every brand, someone with no rule in a brand sees nothing from it on All teams and cannot go online there.