Roles & Permissions for a WhatsApp Inbox

The day you add your second teammate to a shared WhatsApp number, a quiet question shows up: who's allowed to do what? A new sales hire shouldn't be able to fire off a broadcast to your whole list. A part-time support agent doesn't need to see the VIP deals or change billing. And nobody — not even a well-meaning admin — should be deleting conversation history on a whim.

Without roles and permissions on your WhatsApp inbox, everyone gets everything. That's fine with two people who trust each other. It stops being fine the moment you hit five, ten, or twenty agents, or the day someone leaves on bad terms.

This guide is for team leads and ops people who've outgrown "we all just share the login." We'll cover the three roles worth having, how label-gated access lets you scale without exposing every chat to every agent, and the offboarding step most teams forget.

Why a shared WhatsApp number needs roles at all

Front-load the answer: roles exist so the right people can act and the wrong people can't — without you babysitting the inbox. The free WhatsApp Business app and WhatsApp's own multi-device linking give you no permission model whatsoever. Anyone with access can read every chat, message every contact, and delete anything. There's no admin, no member, no audit of who did what.

That's the structural gap. On a personal-phone setup, "access" is binary: you're either holding the phone or you're not. There's no way to say "this agent can reply but not broadcast," or "this contractor sees only their assigned chats."

The risks compound as the team grows:

• A junior agent blasts the whole list. One mistimed broadcast to thousands of contacts is the fastest way to spam complaints — and a banned number.
• Everyone sees everything. Your enterprise pipeline, your founder's DMs, and your refund disputes are all visible to the intern.
• No accountability. When a contact complains "someone was rude," nobody can tell who sent what.
• Offboarding is a fire drill. An agent quits and you're scrambling to figure out what they could touch — and whether they still can.

Roles fix the first three. Clean offboarding fixes the fourth. For the wider picture of how a team inbox should work, see our WhatsApp shared inbox for teams guide.

The three roles worth having: owner, admin, member

Most teams don't need a sprawling permission matrix. Three roles cover the real cases. Here's the model we'd recommend, and what each layer should and shouldn't be able to do.

Member: the front-line agent

A member is your default. They log in, see the chats assigned to them (or the labels they're scoped to — more on that below), reply, leave internal notes and @mentions for teammates, and use shared canned replies. They get the day-to-day tools and none of the levers that can hurt you. Crucially, a member can't broadcast — the single most dangerous action for a junior to have. Most of your team should be members.

Admin: the team lead

Admins run the floor. They can assign chats to agents, set up automations and labels, invite or remove members, and send broadcasts. They see all conversations because they need to triage and reassign. What they shouldn't touch is the business spine: billing, the plan, and the connection to your WhatsApp number itself. That stays with the owner so a departing admin can't lock you out or rack up charges.

Owner: the account holder

There's one owner — usually whoever connected the number. The owner can do everything an admin can, plus the irreversible and financial actions: managing the subscription, changing anyone's role, and disconnecting the WhatsApp number. Keep this tight. One owner, or two co-founders at most. The owner role is not a participation trophy you hand to your fifth hire.

Label-gated access: the part that makes scaling safe

Roles answer "what can this person do." Labels answer "which conversations can they see." For a small team, every agent seeing every chat is fine. For a growing one, it's a liability — and label-gated access is the cleaner fix than carving the inbox into separate numbers.

Here's the idea. You tag conversations with labels (Sales, Support, VIP, Refunds, a specific region or product line), then scope a member to only the labels they're meant to handle. A support contractor sees Support chats and nothing else. A regional rep sees their region. The enterprise pipeline stays invisible to everyone except the people working it.

This matters for three reasons:

1. Least privilege. Agents see only what they need. Less exposure, fewer accidental replies in the wrong thread, cleaner inboxes.
2. Safe contractors and freelancers. You can bring on temporary help scoped to one label without handing over your entire customer base.
3. Focus. A scoped inbox is a faster inbox. Agents aren't scrolling past conversations that aren't theirs.

Pair label scoping with chat assignment and you get a tidy operating model: labels decide what an agent can see, assignment decides what they're responsible for right now. If you're running more than one number, the same logic extends across them — see how a multi-number WhatsApp inbox keeps each team in its lane.

Offboarding: the step most teams skip

The whole point of roles is that they make removal instant and complete. On a shared-phone setup, "offboarding" means changing a password everyone knows, or hoping the ex-agent forgets the login. With a proper role model, you remove one person and:

• Their access ends immediately — no chat is reachable by them anymore.
• Every conversation, note, and deal they touched stays in the workspace. The history belongs to the business, not the person.
• Their assigned chats can be bulk-reassigned to whoever's covering.

Run this as a checklist whenever someone leaves:

1. Remove the member from the workspace (owner or admin action).
2. Reassign their open chats so nothing goes dark.
3. Check no broadcasts are queued under their name.
4. Confirm the owner role still sits with the right person — never let it walk out the door.

That last point is the one that bites teams. If a departing admin somehow holds the owner role or the number connection, you've handed them the keys. Keep ownership separate from day-to-day admin work precisely so this never happens. For the broader system around this, our WhatsApp team collaboration playbook covers the workflow habits that make roles stick.

Where Tenashi fits

Most "shared WhatsApp" setups force a bad trade: either everyone shares one phone with zero access control, or you move to the official API and lose groups, pay per message, and wait on template approvals. Tenashi is the WhatsApp workspace for teams — a shared inbox, real CRM and pipeline, and support desk on your existing number, linked by a QR scan. No new SIM, no porting.

On the roles question specifically, Tenashi gives you owner, admin and member roles out of the box, plus label-gated access so members see only the conversations they're scoped to. Broadcasts stay behind the admin and owner roles, so a new agent can't blast your list. And because every chat, note and deal lives in the workspace, offboarding is one click — the relationship and history stay with your business when an agent leaves.

Two more things that matter as you scale a team on one number. Tenashi works in WhatsApp groups, which the official API structurally can't touch — so broker groups, customer groups and internal channels all sit in the same controlled inbox. And sends are ban-protected: human-paced, warmed up, with duplicate and burst patterns paused before they ship. That's risk reduction, not a guarantee, but it's the safety net you want when several agents share one number. On Growth and Scale plans only, AI can suggest replies and summarize long threads so your team moves faster.

Pricing is flat — Starter $18/mo, Growth $27/mo, Scale $56/mo — with a 3-day Growth trial, no card.

Start your free trial → · See every feature

FAQ

Does WhatsApp have roles and permissions for a shared inbox?

No. The WhatsApp Business app and WhatsApp's multi-device linking have no role model — anyone with access can read every chat, message any contact, and delete history. To get owner, admin and member roles plus scoped access, you need a WhatsApp workspace like Tenashi layered on your existing number.

What's the difference between an admin and a member in a team inbox?

Members are front-line agents: they reply to their assigned chats, add notes, and use canned replies, but can't broadcast, assign chats, or manage the team. Admins run the floor — they assign chats, build automations, invite teammates, and send broadcasts. Billing and disconnecting the number stay with the owner.

How do I stop a new agent from sending a broadcast to everyone?

Assign them the member role rather than admin. In a proper WhatsApp workspace, broadcasting sits behind admin and owner permissions, so a member literally can't reach the broadcast tool. This is the single most important guardrail when onboarding junior or temporary staff to a shared number.

What is label-gated access on a WhatsApp inbox?

It scopes an agent to only the conversations carrying certain labels — like Support, a region, or a product line. The agent sees and replies to those chats and nothing else. It lets you add contractors or specialists without exposing your whole customer base, which is the cleanest way to scale a team safely.

What happens to chats when I remove an agent from the inbox?

Their access ends immediately, but every conversation, note, and deal they handled stays in the workspace — the history belongs to the business, not the person. You then reassign their open chats to whoever's covering. Compare that to a shared phone, where access lingers and history can walk out the door.

How many owners should a WhatsApp workspace have?

One, or two co-founders at most. The owner controls billing, role changes, and the connection to your WhatsApp number — irreversible and financial actions. Keeping ownership tight means a departing admin can never lock you out or run up charges. Everyone else should be an admin or member.

---

Don't wait until your tenth hire to think about access. Start a free trial and give your team a WhatsApp inbox with real roles, scoped access, and clean offboarding — on the number you already use.