Who may see what
Two things decide which cases someone on your team can see: the units they work in, and restricted access for accounts and contacts who may only be served by staff in certain countries, for example under GDPR. This page explains both, and how their agreements let more countries in.
Units
Units decide which cases someone sees at all.
- Agents see the cases of the units they are assigned to, and of every unit below them. Assigning an agent to an organization gives them all of it. Without a unit, an agent sees no cases. You assign units under Users.
- Admins see every unit.
The same goes for what hangs on a unit, such as canned replies. Contacts are shown to the people who can see one of their cases, and accounts to the people working in the account's organization (except accounts restricted to other countries, below).
[!NOTE] Cases outside someone's units don't exist as far as they're concerned: they aren't in the inbox, search, counts or reports, and a link to one answers "not found".
API tokens and AI assistants see what their owner sees, or less (see API tokens). Moving a case to another unit is only possible to a unit you can see yourself, within the same organization.
Restricted access
A unit can say that only certain people may work on its cases: staff working in certain countries, members of certain teams, or named people. An account can say the same by country.
[!IMPORTANT] Everyone else doesn't see those cases at all, admins included.
Where someone works is the Works in country on their person under Users; someone without a country isn't let in by a country.
On a unit
Under Settings → Organization, select the unit and set Who may work on cases:
| Choice | Means |
|---|---|
| Same as the unit above | The default for units. The organization's default is The whole team. |
| The whole team | No restriction. |
| Only the people these rules allow… | A table of rules, each one a Location (staff working in a country), a Team (its members) or a Person. Matching any one rule lets someone in. With no rules, nobody can see the cases. |
To set up rules:
- Add them with + Location, + Team and + Person below the table.
- Remove one with the bin.
- Save.
The people let in still need to work in the unit (see Units): a rule narrows who of them may work on the cases, it doesn't give anyone access to a unit they aren't in. When someone leaves a team, or moves to another country, cases assigned to them that they may no longer handle go back to nobody, with a note on the timeline.
The nearest unit with a setting wins, so a restriction on a unit covers every unit below it unless one of them says otherwise.
On an account
An account can set its own rule for its company's cases, which replaces the unit's. It has its own card on the
account's page, Account access; Change (with Change accounts, account.write) sets it:
| Choice | Means |
|---|---|
| As the case's unit says | The default. |
| The whole team | Everyone, even where the unit is restricted. |
| Only staff working in… | Only staff in the countries you pick. |
The account rule covers the cases of the account's contacts, in every unit. A contact without an account follows the unit's rule. An account restricted to other countries is itself hidden from people outside them, admins too.
Each change is in the audit log as Changed who may work on an account, with the rule before and after.
[!TIP] The account's written consent, when there is one, goes with its agreements: a signed copy, who signed it and when. The rule here is what the desk enforces.
Assignees and notifications
Only people who may handle a case can be assigned to it:
- The assignee lists only offer people who can see the unit and are in an allowed country. Assigning someone else is refused with "… isn't in a country allowed to handle this case".
- Automations that assign, including round-robin, skip people who may not handle the case.
- Notification emails about a restricted case only go to people who may handle it.
- If a restriction keeps you yourself from a case, you can't log it there. See Logging a new case.
When the rule changes
When the rule for a case changes, the desk works it out again straight away. That happens when:
- a unit's or an account's rule changes,
- a case moves to another unit,
- a contact is linked to an account,
- someone's country changes.
Anyone assigned to a case they may no longer handle is unassigned, with a note on the case's timeline, and the case waits for someone who may.