Use roles to control which Aptly features a teammate can use and which settings they can manage. This guide explains how to create and update roles, assign them to users, and check the permissions that affect communication, boards, AI agents, screening, and account administration.
Before you change a role
- Use an account authorized to manage Company Info & Team, typically an administrator.
- Check which users have the role before editing it. A role change affects the people assigned to that role, not just the person whose access you are troubleshooting.
- Grant only the access needed for the person’s work. Be especially careful with personal inbox monitoring, private calendars, applicant data, refunds, paid phone features, and lock master codes.
- Record the current settings before changing them. If only one group needs different access, consider a separate role rather than expanding a shared role.
Checked does not always mean allowed. Permissions beginning with Deny or Block apply a restriction when selected. Require Warning Review adds a review requirement. Read the full label before saving.
Understand the different access settings
A role is one part of a user’s access. Check the relevant resource settings as well.
Access setting | What to check |
Company role | Which features and administrative actions the user is allowed to use, and which restrictions apply. |
Board privacy and membership | Whether the board is public or private, who has been added, and each member’s board access level. A role’s board-configuration permission is different from membership in a private board. |
Shared inbox or phone inbox membership | Whether the user is included in the inbox’s access settings. Permission to manage shared accounts is different from being a member of one particular inbox. |
Personal inbox monitoring | Both the monitored user’s role and the monitoring user’s role must have the appropriate monitoring settings. See the two Channel Monitoring permissions below. |
Automatic conversation sharing | The contact-type role permission and the source inbox’s automatic-sharing setting work together. |
Company settings and feature availability | Some permissions require a connected service or an enabled company feature. For example, password login needs the company setting, and pushing applications to Yardi needs the integration. |
Do not use a role name, a hidden navigation item, or an ordinary board filter as proof that sensitive information is inaccessible. Review the applicable access settings and verify the result with the affected user.
Create or edit a role
- Open your avatar menu and select Settings.
- Select Company Info & Team and find Roles & Permissions.
- To change an existing role, select its pencil icon to open Edit Role. To create a role, select Add Role and enter a clear NAME, such as Screening Reviewer.
- Review ROLE TYPE and the selected permissions. Check allow permissions only where needed, and check deny or block permissions only when you intend to impose that restriction.
- Select Save. Select Cancel if you do not want to apply changes.
The editor lists individual permission checkboxes. The headings in the reference below group related controls to make them easier to find; they are not separate sections in the editor.
ROLE TYPE is separate from the role’s name. The editor offers Organization User, Locked Admin Role, and Guest User. With Locked Admin Role, users outside that role cannot change its permissions; changes must be made by a user in the role. Use the type appropriate to the account being created, and do not change an existing role’s type solely to troubleshoot an individual permission.
Assign a role to a user
- In Company Info & Team, find the user in Members and select their pencil icon. For a new teammate, select Add User.
- Review the Roles field and choose the intended role.
- Select Save. For new teammates, follow the invitation steps in Adding Users to Aptly below.
Changing the user’s role and editing the permissions in a role are different actions. Review both the user’s assigned role and that role’s configuration when troubleshooting access.
Verify the result
Ask a representative user with the affected role to refresh Aptly and check the intended workflow. Some permissions are cached in the session; signing out and signing back in may be needed after a change.
- Confirm that the appropriate navigation and settings are visible.
- Check an approved, non-sensitive example board or inbox and confirm the intended viewing or editing controls.
- For read-only access, check that configuration controls are unavailable without attempting to save a change.
- Verify restrictions as well as allowances. A hidden main Inbox or Calendar does not remove the related email or event features described below.
- Do not test access by sending a bulk message, issuing a refund, deleting a document or inbox, downloading a credit report, or changing a lock.
If access is still wrong, review the role assignment, permission wording, board or inbox membership, and company feature settings before granting broader permissions.
Permission reference
The sections below explain the permission labels and their practical effect. Available controls depend on the role type and features enabled for your company. Viewing, editing, deleting, and managing access are separate responsibilities; do not enable them together automatically.
Account setup
Permission | What it does and when to use it |
Setup - Access all areas of setup | Access company setup areas. Reserve this broad permission for people responsible for administering the account. Subscription and billing management also requires Manage Aptly Subscription/Billing; that permission needs this setup permission to work. |
Setup - Allows inviting guest users | Invite contacts to collaborate as limited guest users. Review the guest’s board access separately; an invitation is not a reason to grant access to unrelated work. |
Setup - Can Change Password | Set or change the user’s Aptly password. Password login also requires the company’s Login With Password setting. This permission alone does not enable password login for the organization. |
Setup - Can Create Inbox | Connect a personal or shared inbox. This is separate from access to the main Inbox screen and from membership in an existing shared inbox. |
Setup - Can Delete Inbox | Delete personal or shared inbox connections. Grant only to people responsible for managing connections; this is not the same as deleting an individual email. |
Setup - Communication Templates | Create, edit, or delete company-wide communication templates. Use for people who maintain approved messaging used by the team. |
Setup - Topics | Manage shared topics in company settings so the team can use a consistent set of conversation labels. |
Setup - Can manage Inbox Crawler | Manage Inbox Crawler, which reads conversations from an eligible inbox to draft knowledge content such as FAQs. The crawler feature must be available for the company; review the source inbox and intended visibility of generated content before running it. |
Setup - Can manage org-wide appearance & custom themes | Create or update the company’s shared custom theme. Updates affect users who have selected that theme; this is different from choosing a personal appearance preference. |
Setup - Manage Aptly Subscription/Billing | Manage Aptly subscription and billing settings. Requires Setup - Access all areas of setup as well as this permission. Assign both only to people authorized to manage the company’s subscription and payment responsibilities. |
Boards and comments
Permission | What it does and when to use it |
Boards - Can install default board views (kanban/table) | Install additional default views, such as Kanban or table views, on a board. Board access must also be reviewed separately. |
Boards - Can modify default board views | Modify default board views. This controls view configuration, rather than granting membership in a private board. |
Boards - Can modify public board settings | Edit public-board settings, including card sources, automations, card fields, forms, and templates. Turning this off does not itself make a public board private. |
Boards - Deny Board Creation | When checked, prevents users with this role from creating boards. Leave unchecked if board creation should not be blocked by this setting. |
Boards - Deny Card Configurations Forms And Templates | When checked, blocks configuration of board cards, forms, and templates. Use for team members who work with established processes but should not redesign them. |
Comments - Can edit comments | Edit or delete the user’s own internal comments after posting them on cards or conversations. This is not permission to edit other people’s comments. |
Inbox and email
Permission | What it does and when to use it |
Channel Admin - Can configure automations on any channel | Configure inbox rules and settings for connected channels. This is an administration permission; review message visibility and shared-inbox membership separately. |
Channel Monitoring Access - Personal channels are viewable by Admin | Allow the personal inboxes of users with this role to be monitored by users whose role has Channel Monitoring Admin enabled. This setting belongs on the role being monitored. |
Channel Monitoring Admin - Can read access enabled channels | Read personal inboxes for users whose role has Channel Monitoring Access enabled. Those inboxes appear under Monitored Inboxes. This setting belongs on the role doing the monitoring; both sides are required. |
Email - Allow sending of bulk messages | Send email to multiple contacts using bulk messaging. Use for staff responsible for campaigns or announcements; review sending-inbox access separately. |
Email - Manage all shared email accounts | Manage shared email inbox settings, including assignment rules and adding or removing users’ access. |
Inbox - Grant access to all company emails from (Contact Type) | Allow access to auto-shared conversations for the specified contact type. The source inbox must also be enrolled in automatic sharing. Related conversations can appear on contacts, locations, and cards; this is not access to every message in the source inbox. |
Inbox - Deny Inbox Access | When checked, removes access to the main Inbox screen. It does not prevent inbox connections when Can Create Inbox is allowed, use of inboxes in automations, or access to related emails on boards. |
Inbox - Convert Personal Inbox to Shared Inbox | Convert a personal inbox into a shared inbox. Review the messages involved and the shared inbox’s Access settings before using it; converting the inbox and deciding who can use it are separate steps. |
The editor lists a separate Inbox - Grant access to all company emails from … checkbox for each contact type. The entries reflect your company’s contact types and may include Applicants, Former Applicants, Guest Users, Other Contacts, Owner/Investors, Owner Prospects, Past Residents, Roommates, Team Members, Tenant Prospects, Tenants/Occupants, and Vendors. Select only the types needed for the role; do not treat one selected type as access to all contacts.
Phone and call recordings
Permission | What it does and when to use it |
Phone - Allow sending of bulk SMS | Send an SMS message to multiple contacts using the bulk SMS composer. Use for staff responsible for group messages; the sending phone number must also be available to them. |
Phone - Allow toggling call recording on outbound calls | Choose whether to record an outbound call made through the Aptly dialer. This is separate from permission to listen to recordings or manage paid phone features. |
Phone - Block listening to call recordings | When checked, blocks the user from listening to call recordings. It is a restriction, not permission to enable recording. |
Phone - Manage all shared phone numbers | Manage shared phone-number settings, including automations and which users can access the phone inbox. |
Phone - Manage paid features (create numbers, call recording, etc) | Manage paid phone features, such as creating numbers and configuring call recording. Assign to people authorized to manage these services and their costs. |
Dashboards calendars and reviews
Permission | What it does and when to use it |
Dashboard - Can view other user's dashboards | Open other users’ dashboards using the dashboard user selector. Use for visibility into team follow-up work; managing their tasks and notifications is a separate permission. |
Dashboard - Can edit/manage other user’s dashboards | Manage tasks and notifications while viewing another user’s dashboard, including completing or deleting them. Use for staff who supervise follow-up work; viewing dashboards is listed separately. |
Private Calendar Admin - Full access to all private calendars | View event details in other users’ private calendars rather than only blocked time. Treat this as access to potentially sensitive calendar information. |
Shared Calendar Admin - Full access to all shared calendars | View event details across shared calendars. Review this separately from the user’s normal access to individual calendars. |
Calendar - Deny Calendar Access | When checked, hides the main Calendar from navigation. Calendar views on boards and calendar events on cards remain available. |
Reports - View | View inbox insights and reporting. Completed review details have a separate permission. |
Can read completed review details | Read completed review or survey details attached as comments to conversations and cards. |
Reviews - Ability to opt out of sending review requests | Choose not to send a review request to an email recipient when archiving the conversation. Use when staff need to handle exceptions to the normal review-request workflow. |
Hiro
Permission | What it does and when to use it |
Hiro - Use the Hiro assistant | Use the Hiro assistant in Aptly. Enable for team members who need to work with the assistant; skills management, bulk actions, and token-limit changes have separate permissions. |
Hiro - Manage organization skills | Manage the organization’s Hiro skills. Assign to people responsible for maintaining the skills used by the team, rather than everyone who uses the assistant. |
Hiro - Send bulk actions (texts to many contacts) | Use Hiro bulk actions, including sending texts to many contacts. Limit to staff responsible for group communication and review the intended recipients before sending. |
Hiro - Adjust organization token limit up to the global maximum | Adjust the organization’s Hiro token limit, up to the global maximum. Assign to people responsible for managing assistant usage; this permission does not allow raising the limit above that maximum. |
AI agents
Permission | What it does and when to use it |
Aptly AI Agents - Ability to view Aptly AI Agents | Open the AI Agents area, review activity and configuration, and inspect agent details. Enable this with editing off for read-only oversight; viewing alone does not allow configuration changes. |
Aptly AI Agents - Ability to edit Aptly AI Agents | Edit AI agent configuration, including knowledge, capabilities, routing, and conversation settings. For users who need to manage agents, enable viewing as well as editing. |
Aptly AI Agents - Archive and unarchive calls in the activity history | Archive or unarchive calls in AI agent activity history. Use for people maintaining that history; this action is separate from changing agent configuration. |
For read-only oversight, enable Ability to view Aptly AI Agents and leave Ability to edit Aptly AI Agents off. Enable both for staff responsible for configuration. These permissions control what a human user can do in Aptly; the agent’s own capabilities and connected resources are configured separately.
E-signature
Permission | What it does and when to use it |
Esignature - Create Documents | Create and send new e-signature documents. This is a sending permission, not a control for hiding previously sent documents. |
Esignature - Countersign Documents | Countersign e-signature documents. This is separate from creating or deleting documents. |
Esignature - Can delete e-signature documents | Delete e-signature documents. Keep deletion access limited; creating and countersigning documents have separate permissions. |
Esignature - Reassign draft reviewers | Change the assigned reviewers for a draft e-signature document. Use when responsibility for a draft review needs to move to another person. Countersigning remains a separate permission. |
Screening
Permission | What it does and when to use it |
Screening - Allow Setup | Configure Screening Management settings. Assign to the people maintaining the screening process, rather than every person reviewing an application. |
Screening - Allow Accepting/Declining Applications | Approve or decline screening applications in the Approval Center. This does not replace the separate controls for viewing sensitive applicant information. |
Screening – Require Warning Review Before Approval Decision | Require review of screening warnings or rules before an approval decision. Complete the Approval Center’s required review, pass/fail selections, and comments before approving; this is a requirement, not permission to approve on its own. |
Screening - Allow Viewing Credit Reports | Open and view full applicant credit reports in Aptly. Downloading a PDF is controlled separately. |
Screening - Allow Downloading Of Consumer Credit Reports | Download a PDF copy of an applicant’s consumer credit report. Review this separately from viewing reports in Aptly, because a download creates a copy outside the application. |
Screening - Allow Viewing DOB | View an applicant’s date of birth. Grant only when the person’s responsibilities require this information. |
Screening - Allow Viewing SSN | View an applicant’s Social Security Number. Keep this sensitive-data permission limited to authorized staff who need it. |
Screening - Allow Viewing Verifast Reports | View available VeriFast verification results, including identity and bank-verification reports. |
Screening - Allow Requesting Fraud Checks | Request a document fraud check on applicant-provided attachments. Use for staff who review supporting application documents. |
Screening - Allow Processing Refunds | Issue application-fee refunds using the refund control in the fee details. Limit to staff authorized to make financial adjustments. |
Screening - Allow Pushing Applications to Yardi | Push an application to Yardi. This applies to accounts using the Yardi integration; enabling the permission does not create the integration. |
Screening - Allow Sharing of Applications to the Portal | Share an application with an external contact through the application portal. Review the recipient and information being shared before using this action. |
Aptly Access
Permission | What it does and when to use it |
Aptly Access - Allow viewing master code | View a paired lock’s master code. The code can unlock the lock; give this access only to authorized staff and do not include codes in routine messages. |
Knowledge apps and developer access
Permission | What it does and when to use it |
Knowledge - Allow Reorder Documents | Change the ordering of Knowledge documents. Use for people who maintain the organization of shared documentation; review each page’s own sharing and editing settings separately. |
Marketplace - Enable/disable apps and manage integration settings | Enable or disable apps and manage integration settings in the App Store. Limit to people responsible for connected services, because changes can affect how the company’s systems work together. |
Developer Tokens - Generate board level and delegate tokens for building apps and integrations | Generate board-level and delegate tokens for apps and integrations. Board tokens can be scoped to specific boards and read, insert, or update actions. Treat tokens as credentials, share them only with authorized developers or systems, and choose the smallest scope the integration needs. |
Choose access for the work people do
Roles may be named Admin, Manager, Team Member, or Guest User, and you can create additional roles. Review the actual settings in your account instead of assuming a role name guarantees a fixed set of permissions.
- Account administrators: Grant the setup and management controls they are responsible for. Review sensitive-data access, inbox monitoring, and financial actions individually rather than selecting every checkbox.
- Managers: Start with the visibility needed to supervise work. Add editing, refunds, bulk messaging, or configuration access only where they own those responsibilities.
- Team members: Provide access to the boards and inboxes they work in. Where appropriate, restrict board creation and configuration so they can follow an established process without redesigning it.
- Screening reviewers: Separate application decisions from access to SSNs, dates of birth, credit-report downloads, refunds, and external sharing.
- Guest collaborators: Use the guest invitation workflow and review the access granted on each board. Guest users can see only boards they are explicitly invited to. A board being public does not itself grant guest access, and public company information is not automatically visible to guests. They have a limited feature set, so do not treat a guest role as a substitute for a full team-member account.
Common questions
Why can a user still see an email when Inbox access is denied
Deny Inbox Access hides the main Inbox. Related emails can still be available on boards, and inboxes can still be used in automations. Connecting an inbox is controlled separately by Can Create Inbox.
Why does a user with a monitoring role not see a personal inbox
Check both roles. The viewer needs Channel Monitoring Admin, and the personal inbox owner’s role needs Channel Monitoring Access. Shared-inbox membership and contact-type auto-sharing are separate ways of controlling access; they are not the monitoring setup.
Why is password login unavailable
Password login depends on the company’s Login With Password setting as well as the user role’s Can Change Password permission. Do not change company authentication settings simply to troubleshoot an unrelated access issue.
Why can a user see an AI agent but not edit it
Viewing and editing are separate permissions. View-only access is appropriate for monitoring activity without changing agent behavior. A user responsible for configuration should have both permissions.