Business Messaging: Access, Roles & Permissions Across Platforms

When a business wants to message customers on a given platform, three governance questions decide how much work — and how much dependency — is involved:

• Who can own the account, and what legal identity or verification is required.
• What roles exist inside it — who can send, who can manage settings, who can add other people.
• Who holds the technical access — the API keys or tokens — the brand itself, or a mandatory intermediary.

This page compares those three across the major channels. It is a neutral reference: no platform here is endorsed or integrated, and the model each platform publishes is described as-is (where a platform documents no role hierarchy, that is stated rather than inferred).

The most consequential axis is whether a business can hold its own technical credentials or must route through an approved partner. It is a spectrum:

• Mandatory intermediary — the brand cannot self-serve. Apple Messages for Business requires an approved Messaging Service Provider (MSP); Google RCS for Business works through a certified RCS Solution Provider; KakaoTalk business messaging requires a Kakao-authorized agency and a Kakao-issued sender key; Viber Business Messages is applied for and operated through a partner.
• Optional intermediary — the brand may hold its own tokens or delegate. WhatsApp, Messenger and Instagram let a business run its own Meta app or hand a Tech Provider a scoped token. Zalo and LINE let the account owner mint and revoke their own API tokens. WeChat issues the brand an AppID/secret directly, though overseas brands often use an agency in practice.
• No intermediary at all — Telegram is the purest: a bot token is issued instantly and the brand holds it directly.

The table below summarizes all three axes.

The maturity of the named-role model varies enormously:

• Granular, documented matrices. WhatsApp and the wider Meta platform separate Full control from Partial access, add Finance and integration permissions, and issue scoped system-user tokens. LINE runs two distinct consoles — a business console (Admin, Operator, and restricted operator variants) and a developer console (provider/channel roles). Zalo publishes six explicitly named roles, from Administrator down to Analyst and Customer care.
• Named, but no permission matrix. Apple (Administrator, Member, Read-only, plus three program contacts), WeChat (one Administrator plus Operators), and KakaoTalk (channel Master/Manager plus developer-app roles) name their roles without publishing a full rights table.
• Thin or token-based. Google RCS documents only a partner account owner and a technical contact; Viber publishes no role taxonomy at all and pushes team access onto the partner platform; Telegram has no organizational hierarchy — for bots, whoever holds the token has full control, and Telegram Business instead grants a connected bot a fine-grained, per-chat set of rights the account owner can revoke.
• Borrowed. Instagram has no messaging role model of its own — it inherits Meta's Page and Business Portfolio structure.

Western platforms generally verify a business but rarely block account creation on a registered legal entity. Asian platforms typically do:

• WeChat requires a Chinese business license for a mainland account; overseas businesses are restricted to a single verified Service Account.
• KakaoTalk business messaging requires a Korean business registration certificate, and foreign companies usually cannot self-verify — they work through a local agency.
• Zalo requires a Vietnamese business registration license for a verified Official Account; without one, an account is limited to advertising only.
• LINE requires passing regional business screening to earn a verified (searchable) account.

For a business operating across regions, this means the same "set up a messaging presence" task is a light branding step in one market and a local-entity, local-agency project in another.

These differences decide real things: how fast you can go live, whether you depend on a partner you cannot remove, who on your team can actually send a message, and whether you even qualify to open an account in a given market.

The practical takeaway is that "business messaging" is not one capability but a dozen different governance regimes. And once a business operates on more than one of them, the account models diverge but the conversations still belong to the same people — which is the problem a unified inbox exists to solve: one relationship per person, regardless of which channel's permission model the message arrived through.

The per-platform pages below go into each governance model in detail, with sources.