Roles & Permissions

Junto uses six roles to control what users can see and do within your organization. Five are for your own staff and inherit all permissions from the roles below them. The sixth, Customer, is for external client contacts and works differently.

Role Overview

Role	Description
Owner	Full system access including billing and subscription management
Administrator	Full operational access — integrations, settings, user management
Manager	Operational metrics, analytics, and advisor insights
Operator	Day-to-day operations, approve agent actions and recommendations
Technician	Work tickets, run runbooks, use the assistant
Customer	External client contact with read-only access to their own company's data, through an AI client only

What Each Role Can Do

Owner

Everything an Administrator can do, plus:

• Manage billing and subscription
• Assign the Owner role to other members

Administrator

Everything a Manager can do, plus:

• Configure and manage all integrations
• Invite users, update roles, and remove members
• Manage organization settings and agent configuration (custom instructions, organization knowledge, toolsets and approval policies)
• Configure signal processors
• Manage notification channels
• View the audit log
• Configure the service catalog and weekly summaries
• Manage the runbook template library

Manager

Everything an Operator can do, plus:

• View the ROI dashboard and technician metrics
• Access the Timeline view
• Turn on auto-run for approved runbooks
• Launch Workspace prompt packs

Operator

Everything a Technician can do, plus:

• Approve, reject, or dismiss Advisor recommendations
• Approve or deny agent Action Requests
• Handle real-time agent tool approval requests

Technician

Base level of access for all staff members:

• View and work tickets
• View and execute runbooks
• Use the assistant and Workspaces
• View companies and their details
• View Audits, Escalations, and the main dashboard
• Connect an AI client through MCP

Customer

A Customer account is for an external contact at one of your client companies. It is different from the staff roles:

• It is bound to a single company, chosen when the account is created.
• It can only access Junto through an MCP connection, such as Claude or ChatGPT. Customer accounts cannot sign in to the Junto web app.
• Access is read-only and limited to that company's approved support and infrastructure data.

Use it to give a client's IT contact a way to ask about their own tickets and environment from their AI client without giving them access to your other clients or to any actions that change data.

Permission Flags

In addition to roles, two permission flags can be enabled for any staff member regardless of their role. Administrators manage these per user in Settings > Users.

Billing Admin

Controls whether the AI agent can use financial tools (agreements, invoices, financial reports) when acting on behalf of this user. A Technician with Billing Admin enabled can run financial reports through the agent, while an Administrator without it cannot.

Default: Off.

Escalation Approver

Controls whether this user receives escalation notifications (via Slack or Teams DM) and can approve or reject escalation requests. At least one user in your organization should have this enabled.

Default: Off.

Inviting and Managing Users

Administrators and Owners manage members in Settings > Users.

1. Click Add User.
2. Enter the person's email address and full name.
3. Choose a role. Only an Owner can assign the Owner role.
4. If you chose Customer, select the company the account is bound to.
5. Optionally enable Escalation Approver or Billing Admin.
6. Save. The person can then sign in to Junto with that email address.

To change someone's role or flags later, click the pencil icon on their row. Only an Owner can edit or remove another Owner.

Page Access by Role

Some pages also depend on your organization's plan. The table shows the minimum role; a page may still be locked on a lower plan.

Page	Minimum Role
Dashboard	Technician
MCP	Technician
Explore (assistant)	Technician
Workspaces	Technician
Companies	Technician
Tickets	Technician
Escalations	Technician (approving requires the Escalation Approver flag)
Audits	Technician
Runbooks	Technician
Advisor	Technician (approving requires Operator)
Timeline	Manager
ROI	Manager
Dispatch recommendation activity	Manager (when available)
Secure Send management page	Administrator (paid plans)
Settings, Processors, Audit Log	Administrator
Billing	Owner

Agent Tool Policies

Administrators can configure approval policies for each agent tool under Settings > AI Settings > Toolsets. Policies control whether the agent can use a tool automatically or must request approval first. See AI Settings for more on configuring agent behavior.