> For the complete documentation index, see [llms.txt](https://docs.cekat.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cekat.ai/en/workspace-and-settings/user-management-and-workspace-permissions.md).
# User Management & Workspace Permissions
**Before you start**
* This feature is available once User Management is enabled in your workspace. Until then, you'll see the older **User** and **CRM User Settings** menus.
* You need permission from the Owner to open User Management. If your permission is **No Access**, the menu is locked.
* Have each new user's name, email, products and roles ready before you invite them.
### About RBAC & User Management
*Role-based access control* (RBAC) separates two things: workspace settings permissions (who can manage users, billing and security) and product access (which products someone can open, and with what role). Give each person only the permissions and roles their work actually needs.
If you used the old menus before, here's what's changed:
* Chat and CRM user settings, which used to be separate, now live together in one **Users Management** menu, with an **All Users** tab and a tab for each product.
* Workspace permissions are now controlled in one place. You can set **User Management**, **Usage & Billing** and **Security** separately for each person.
* Product access, which used to be scattered across each product's settings, can now be assigned from the same user management flow.
* If your account is eligible, you'll see a Your Account page when you log in and choose from your existing businesses, instead of going straight into the old Chat experience.
### Opening User Management and finding users
1. Log in, then choose your *business card* if the business selection page appears.
2. Click the **Settings** icon at the top right, then choose **Users Management → All Users**.
3. If you see **No Access**, ask your Owner for permission.
**Reviewing the user list**
Each row shows the user's name and email, an Owner/Member label, Account Status, three global permissions (User Management, Usage & Billing, Security), Online Status and Product Access.
* Click the number in the **Product Access** column (for example "2 Products") to see which products are assigned to that user.
* **Online/Offline** only shows availability. It doesn't activate or deactivate the account.
**Searching and filtering**
* Search by name or email using the **Search users by name or email** box.
* Choose one **Account Status** (Active, Pending or Deactivated) and one or more products under **Product Access**. Choosing Chat and CRM shows users who have either one.
* Combine filters with a name or email search to narrow things down. If no users show up, clear your active filters.
**Other ways to find users**
* Use pagination and choose 10/25/50/100 rows per page.
* Filters may reset when you move to another page.
* Open a product tab (Chat, CRM, Marketing and so on) to see the users assigned to that product. A locked tab means your workspace doesn't subscribe to that product yet, or you don't have access to it yourself.
### Inviting a new user
1. In **All Users**, click **Add User**.
2. Enter a **Name** (required, up to 255 characters) and a valid **Email**. An email that's already registered in your business can't be added again. If that user is already Pending, use **Resend Invitation** from the three-dot menu instead of creating a new user.
3. Set the **Global Permission**: choose **No Access**, **Can View** or **Can Manage** separately for **User Management**, **Usage & Billing** and **Security**. New users default to No Access for all three, and that's fine as long as they only work in the products assigned to them.
4. Under **Assign to product**, tick at least one eligible product, then choose a role. A note such as "6 of 7 seats used" shows how much capacity is left. One person can have a different role in each product. Products outside your workspace subscription won't appear in this list.
5. Click **Send Invite**. The user appears with **Pending** status.
### Accepting or resending an invitation
* The invited user opens the "You're invited to join Cekat" email and clicks **Accept Invitation**. For a new account, they enter and confirm a password that meets the requirements shown, click **Update Password**, then log in. Once activation is done, refresh the user list to see the latest status (Active).
* **Resending a pending invitation**: in All Users, open the three-dot menu on that user and choose **Resend Invitation**. Ask the user to use the new invitation email. This option isn't available for Active or Deactivated users.
* **Invitation link is invalid or expired**: ask the Owner or an authorized admin to send a new invitation. Don't create a duplicate user to get around a pending invitation.
### Changing a user's access
* **Changing global permissions**: in All Users, change the permission dropdowns directly on the user's row, or open the three-dot menu → **Edit**. **Can Manage** lets the user take management actions in that area, **Can View** is read-only, and **No Access** blocks the area completely, including through direct links.
* **Changing a user's details and products**: open **Edit**, change the name or the assigned products and roles, then click **Save Changes**. Email can't be changed here. After saving, double-check the permissions and Product Access count, then verify in the related product tab.
* **Owner protection**: the Owner's three global permissions are always Can Manage and can't be changed from the Owner's row. The Owner also can't deactivate their own account. Having product access doesn't automatically grant permission to manage users, billing or security.
### Assigning product roles and seats
**Assigning users to a product**
1. Open **Users Management** and choose the product tab you want.
2. With Can Manage permission for that product, click **Assign User** (or **Add Agent**).
3. Search for an existing user by name or email, choose the user and their role, then click **Assign User** and **Save Changes**. For someone who isn't in your business yet, use **+ Add Users**.
How each product differs:
* **Chat**: choose **Super Agent**, **Supervisor** or **Agent**. Chat roles are separate from the User Management global permission, so changing one doesn't affect the other.
* **CRM**: choose **Administrator** or **Basic User**, based on the CRM hierarchy configured for your workspace.
* **Automation, Analytics, Ticketing, Orders, Broadcast/Blasting and Dev Tools**: in Phase 1, these products use access-only roles with no tiered role options, so the role field may be disabled.
**Seat capacity**
* Chat and CRM seats follow your subscription plan. Check how many seats are used and available on the product page or when assigning users, for example "6 of 7 seats used".
* If a product is full, the assign button stays disabled until a seat frees up. Use **Add more seats** if that option appears.
* Users with Usage & Billing = Can Manage can click **Add more seats** to open the billing page. If you don't have this permission, contact the Owner or whoever manages billing.
* Assigning one person to several products uses a seat in each of those products.
### Account status and deactivating users
* **Active**: the user has finished activation. Their global permissions and assigned products decide what they can access.
* **Pending**: the invitation hasn't been accepted yet.
* **Deactivating a user (Owner only)**: in All Users, open the three-dot menu on the user → **Deactivate**. Check the name, email and affected products, add a reason if you like (optional), then click **Deactivate User**. Click **Cancel** to back out and leave their access as it was.
* **After deactivation**: the user stays in your business list with Deactivated status, loses all product access, and their product seats are freed up. Their Product Access drops to 0, all three global permissions become No Access, and they disappear from each product's user list. They'll receive an email letting them know.
* **If your own account is deactivated**: after a refresh, you may see "Your access has been deactivated" or restricted product access. Contact your workspace admin to ask for reactivation.
### Common questions
* **The User Management menu doesn't appear**: ask your Owner whether the new experience is turned on and whether you have permission. Businesses outside the rollout may still see the old User/CRM User Settings menus.
* **I can't open a product**: ask the Owner to check the business subscription, your product assignments and your account status. Opening a direct URL won't get around these access restrictions.
* **A button is disabled or missing**: if your permission is Can View, the view is read-only by design. Also check your product access, remaining seats, and any fields locked for the Owner or your own role.
* **Send Invite is disabled**: enter a valid name and email, assign at least one product, and make sure that product still has a free seat. For a duplicate Pending email, resend the existing invitation instead of creating a new user.
* **A user doesn't show up in results**: clear your search and filters, check other pages, then refresh after activation or permission changes.
**Tip:** review a member's settings permissions and product assignments together, and give them only the access their work actually needs.
### Limitations
* Automation, Analytics, Ticketing, Orders, Broadcast/Blasting and Dev Tools use access-only roles; tiered role options like those in Chat and CRM aren't available yet.
* A user's email can't be changed through Edit User.
* The Owner can't change their own global permissions or deactivate their own account.
* Search filters may reset when you move to another page.