Business Messaging Access, Roles and Permissions

A shared inbox does not by itself tell you who owns the underlying channel. A former employee may still hold the phone number that signs in to a messaging app. An agency may have a developer token even after its human users leave a console. A provider may deliver messages for a brand while the brand still controls registration. Audit those separately: the customer-facing asset, each human identity and each machine credential.

Write down the exact asset before granting access. For WhatsApp that may be an app phone or a WhatsApp Business Account and phone number in a Meta business portfolio; Meta’s Cloud API reference uses portfolio, account and phone-number IDs separately. For Telegram, a user account may turn on Business features, while a bot has its own token and a group has its own owner and administrators. Telegram’s Business documentation and BotFather guide describe those as different controls.

Then ask what a person actually needs to do. Someone answering customers needs conversation access, while a developer may need a channel secret or a service-account key. A finance owner may need billing access but no inbox access. Do not hand out the broadest role merely because the UI offers it first. The useful question is whether that person can invite others, change the sender identity, disclose a token, or disconnect the production integration.

Finally, inventory the path a message takes. On LINE, the Official Account Manager and Developers Console have different permissions. On Google RCS for Business, the partner account holds agents and service-account keys. On Viber Business Messages, a messaging partner helps open and operate the account. These are practical differences in who can stop a bad integration, recover a sender, and hand work to another team.

This table is a starting map as of November 2026. Role names are the platforms’ own terms; where a platform names no role, the table says so rather than guessing one. Each row ends with the guide path. The linked guide list directly after the table opens the corresponding page.

• Telegram business account roles: the account holder, connected bots, group admins and BotFather.
• WhatsApp business account roles: the app phone, linked devices, Meta business assets and Cloud API.
• WeChat Official Account roles: the account administrator and developer connection.
• LINE Official Account roles: Manager permissions and developer roles.
• KakaoTalk business account roles: Channel Master, Manager and Biz app ownership.
• Instagram business messaging roles: professional-account and API access.
• Facebook Messenger business roles: Page and app access.
• RCS business messaging roles: partner roles, agents and service keys.
• Viber business account roles: partner account and brand access.
• Zalo Official Account roles: six OA staff roles and app authorization.
• Apple Messages for Business account: registration and provider handoff.

If you are deciding between the WhatsApp phone app and an API integration, read WhatsApp Business vs Business API for CRM before assigning anyone a role. The app’s linked devices and the Platform’s system users solve different problems.

Telegram Business features attach to a user account. Telegram’s Business API description lists business hours, location, greeting and away messages and connected bots. Its 2026 product update says every user can connect a bot under Settings > Chat Automation, while a Premium subscription supplies the broader Business feature set. The person controlling the mobile number and 2-Step Verification remains central to account recovery. A group or channel adds another layer: the owner can appoint admins with specific chat admin rights. A BotFather token controls the bot independently of those human group roles.

The WhatsApp Business app is also phone based, but a linked device is a session on the primary account, not a share of phone-number ownership. WhatsApp’s Meta Business Suite inbox guide describes the standard linked-device arrangement and the separate inbox surface. Business app features describe higher device and agent capacity with Meta Verified. That paid capacity does not turn an app device into a Cloud API system user.

WhatsApp Business Platform moves the integration into Meta assets. Meta’s Cloud API collection distinguishes short-lived user tokens from system-user tokens and names the management and messaging permissions. The business also needs to know the portfolio, WhatsApp Business Account and phone-number IDs involved. If an agency built the integration, confirm which business portfolio holds the number and which system user issued the token before removing the agency’s people. The answer determines whether the next team can keep the sender online.

Weixin Official Accounts come in Subscription and Service forms in Tencent’s product overview. A 2025 Tencent Cloud integration guide describes an Official Account AppID and administrator approval through a bound personal WeChat account; it is an older, machine-translated setup guide, so check the live Official Account console before following a menu label. For an audit, record who can approve a connection with that personal WeChat identity and who can rotate the integration secret. Those may be different people.

LINE splits everyday account work from developer work. The Official Account help names Administrator and Operator for Manager access. The Developers Console role guide separately names provider Admin and Member and channel Admin, Member and Tester. A support agent can therefore have Manager inbox access without the ability to see a channel secret; a developer can have channel access without owning the public account. LINE’s Messaging API setup ties the API channel to a provider and Official Account, which is why a provider created under an agency login deserves special scrutiny.

Kakao also separates the Kakao Talk Channel from the developer app. The Channel concepts guide identifies the Channel Master and Manager. The Kakao Sync FAQ distinguishes those from app Owner and Editor and describes matching business registration for a Biz app connection. Removing an agency as a Channel Manager does not by itself review its developer-app access. Check both assets and the registered business information used to connect them.

Zalo Official Account guidance published in October 2026 lists six Vietnamese staff roles: Quản trị viên, Soạn nội dung, Phân tích viên, Chăm sóc KH, Nhân viên quảng cáo, and Quản lý gói và liên kết. Its OA setup guide gives the role and plan context; OA OpenAPI guidance describes authorizing a Zalo App. A person who replies to customers, a person who manages an OA package, and an app that calls the API are three separate grants. Audit each one before changing the legal representative’s or owner’s personal Zalo access.

Instagram’s API targets professional Businesses and Creators according to Meta’s Instagram API collection. A person may be able to sign in to the Instagram account while a separate Meta app still holds an API token. When an agency changes, look for both human account access and app authorization. A password reset alone is an incomplete integration review if the app remains authorized.

For Facebook Messenger, Meta’s Messenger Platform API collection requires a Facebook Page, a Meta app and the pages_messaging permission. This is a useful three-item audit: who can control the Page, who can change the app, and which token lets the app send or receive Page messages? If a contractor was given Page access to answer messages, that is different from giving a developer control of the app. Record the Page and app IDs with the business, then test a harmless inbound reply after changing either grant.

Both platforms can be staffed through tools that have their own user lists. A seat in a customer support tool is not proof that the person lacks Meta access, and removing a Meta user is not proof that the tool’s token has been revoked. Treat the tool as another integration in the credential inventory. Ask the provider to show its offboarding path and the asset IDs it uses, so the next provider can be added without guessing which Page or professional account is live.

Google’s RCS partner-account guide names Owner, Manager and Reader, describes service-account keys, and says Owner removal needs support. A brand’s representative must approve brand verification and launch. If your agency runs the partner account, obtain the partner-account ID, agent ID, key inventory and brand representative contact while the relationship is healthy. A replacement provider cannot infer those from the customer-facing sender name.

Viber’s Business Messages product page describes verified business accounts and API delivery, while its business FAQ tells brands to start with an approved messaging partner. A September 2026 portal update says two-factor authentication becomes mandatory for partner-portal users on October 19, 2026, using a code sent to the designated business email. That makes the partner’s current portal email part of an access audit. Ask for the provider’s user list and escalation contact; Viber’s public product material does not supply a universal brand-side staff-role matrix to assume.

Apple Messages for Business is distinct from a staff member’s iMessage account. Apple’s Messages privacy page distinguishes iMessage from Apple Messages for Business. Its July 2026 registration guide says the business registers in Apple Business Register, selects an approved Messaging Service Provider, and can add organization members as Administrator or Read-only. Apple’s Messages for Business FAQ says the MSP supplies the software for agents to answer customer messages. The operational question is therefore who holds Apple Business Register administration and who administers the provider’s conversation workspace. Get both contacts and the business account identifier into the handoff record. Do not treat a provider seat as ownership of the Apple registration.

Build a small role request instead of asking for “admin access.” State the task, asset and expiry. For example: “Reply to LINE customer messages for two weeks in Official Account Manager,” or “rotate the RCS service-account key for agent A.” The request identifies which console matters and when the grant should end. It also makes a later access review possible: a reviewer can compare the role with the work, rather than guessing why the person was invited.

Different consoles support different boundaries. LINE’s developer role table is precise about which provider or channel members can edit and see secrets. Google’s partner roles separate Reader from Manager and Owner. Telegram’s BusinessBotRights constructor provides granular bot permissions, such as reply, delete or profile edits. In each case, choose from the controls the platform actually exposes. Do not substitute a generic “editor” label in your team spreadsheet and forget the platform’s real permission.

Keep two trusted administrators or recovery paths where the platform permits them, and use individual identities for routine work. The exact backup differs: a second human with console control, an owner who can recover a phone, or a brand representative who can speak to a provider. Do not give a shared credential to the whole team to create redundancy. It obscures who changed a token, who removed a number, and whose device still has a session. A small access register should name the current holder and an accountable backup without copying the secret itself.

A support agent may only need to answer assigned conversations. Granting the same person a channel secret or business portfolio control creates a wider path to act as the brand. Conversely, an engineer who configures a webhook may have no need to read customer messages. This division is especially useful during agency work: the agency can have a timed integration grant while the brand keeps the public account and its recovery route.

In the WhatsApp Business app, the linked-device and Meta Business Suite guide offers ways to share handling, but those devices still attach to the business phone. In Telegram, a connected bot can handle business chats according to the account holder’s configured scopes and rights. In Zalo, conversation-management guidance ties assignment to OA staff rights and plan features. Three teams can all say “shared inbox” while having three different ways to revoke an agent.

When evaluating a new inbox, ask it to identify every underlying asset it will connect, the permission it asks for, and how to disconnect it. Test whether an agent removed from that inbox can still sign in to the native channel or the developer console. Also test whether removing the inbox breaks message delivery for customers. The first test catches hidden access; the second catches a missing replacement route. Neither test is answered by a seat count in a contract.

Machine access is a separate offboarding track. Telegram’s bot guide says anyone with a bot token can control the bot and shows BotFather commands for generating a new token. LINE’s Messaging API setup uses a channel access token. Meta’s WhatsApp Cloud API collection distinguishes temporary user tokens from system-user tokens and the permissions attached to them. Google’s RCS partner guide describes service-account keys and their limit. These credentials are not interchangeable and should not be pasted into one generic “API key” column without an issuer and scope.

For each credential record the issuer, associated asset ID, intended integration, scopes, creation date, rotation owner and revocation path. Store the secret in a managed secret store, not in the access register or a handoff document. A practical example: “Cloud API system user for the order-status service; messaging permission on WABA X; owned by platform engineering; rotate through Meta business settings.” That note is useful even when the token value is deliberately absent.

Rotate when a person with access to the secret leaves, when a repository or ticket exposed it, or when a provider changes. Stage the replacement first: create the new credential with the same required permissions, deploy it, send a test message or receive a test webhook, and then revoke the old one. A bot or agent may appear healthy until the next customer message, so test the actual delivery path. Where a platform requires support or partner action, include the ticket and provider contact in the runbook.

Start by identifying the live sender and its recovery route. For an app phone, confirm the business controls the number and a current device. For a developer console, confirm a business-controlled owner or administrator can invite people. For a partner channel, confirm the brand representative and support path. Do this before removing the person who may be your only path back in.

Next, transfer operational work. Reassign open conversations, schedule coverage for incoming messages, and move the bot or webhook configuration to a maintained account. Verify the successor can answer a real inbound customer test and can view the settings needed for the role. If the departing person was the only one who could approve a channel connection, establish the replacement approval path before disabling that identity.

Then remove human access in every layer: native mobile sessions, Official Account Manager, developer console, Meta portfolio or app, partner portal and the shared inbox. For Telegram, Devices and active sessions and 2-Step Verification matter alongside group/channel admin rights. For LINE, check both its Official Account help and developer roles. For WhatsApp, remove linked devices and review Cloud API system users separately. Keep a dated record of who checked each surface.

Finally, rotate any credential the person could read or export, remove obsolete webhook destinations, and check the provider’s own user list. Observe delivery and replies after the change. The order matters: revoking a token before the replacement is live can strand customer requests; leaving the old token active indefinitely leaves access that a console user list will not reveal. Finish with a short audit note naming the assets tested, the old grants removed and any support request still open.

A badge answers a customer-facing identity question, not an internal permission question. Telegram’s verification guide covers verified public channels, groups and bots; it does not make a bot token safer. WhatsApp’s Meta Verified business material describes a badge and app features, but the phone, linked devices and Platform credentials still need an access audit. Viber’s Business Messages page describes a verified business presence; its partner portal has a separate sign-in path.

Likewise, business verification and API launch are distinct in some systems. Google’s RCS brand-verification guide involves a brand representative; the partner account controls users and keys. LINE’s account screening should not be confused with a developer channel role. Record the badge or approval state in the brand inventory, then review permissions on the actual control plane. A founder seeing a verified sender in the app cannot conclude that a former agency no longer has API access.

Mistake: the founder’s phone becomes the company’s only recovery route. The team invites agents to an inbox but never records who can recover the original Telegram or WhatsApp phone. When that phone is lost, the team cannot solve ownership from the inbox settings. Document the number holder and follow the platform’s recovery setup before adding staff.

Mistake: removing a human while leaving their integration. An agency user disappears from a developer console, but its Telegram bot token, Meta app token or RCS service key remains in production. Review the secret inventory and rotate or revoke what the agency could use. Telegram’s BotFather guide, Meta’s Cloud API token model and Google’s service-account guidance show three different revocation paths.

Mistake: checking only one of two consoles. A LINE Operator leaves the Manager but remains a Developers Console channel Admin. A Kakao Channel Manager is removed but still owns the Biz app. A Zalo OA staff member leaves while an authorized Zalo App remains connected. Audit the public account and developer asset together.

Mistake: treating a verified badge as a contract or role. A customer sees a trusted brand mark, while an ex-contractor still has a device session. Verification says something about brand presentation or review; it does not replace a user list or session inventory.

Mistake: assuming every market has the same setup. Zalo’s October 2026 OA guide publishes plan-dependent staff capacity. RCS availability and agent launch depend on Google’s carrier and brand process. Viber’s messaging partner directory is filterable by destination country. Check the current local product and plan before promising a universal seat count or launch date.