Your social media team just grew from "you doing everything" to three people. One writes content. One handles the inbox. One approves what goes out. In theory, each person should see only what they need and do only what they are authorized to do. In practice, you gave all three the admin password because your tool doesn't have real access controls — or charges $50 per user per month for the privilege.
Role-based access control is not an enterprise feature. It is a basic requirement for any team larger than one. The question is not whether you need it — it is whether your tool gives it to you without doubling your bill.
How Roles Work in LigiComms
LigiComms has four levels of roles, each serving a different purpose:
System Roles (Built-In)
- SuperAdmin — the platform owner. Manages tenants, subscription plans, pricing, and platform-level settings. Exempt from login gates and subscription restrictions.
- Admin — the tenant (business) owner. Controls everything within their own workspace: brands, channels, staff, settings, CRM, templates, publishing, billing.
Global Custom Roles
- Manager — read access to brands, channels, posts, messaging logs, templates, wallet, and notifications. Can submit, review, approve, and publish in the approval workflow.
- Editor — similar to Manager but without approval/publishing rights. Creates drafts and submits for review. The content creator role.
Tenant-Scoped Custom Roles
Beyond the four built-in roles, the Admin can create custom roles per tenant — Reviewer, Intern, Social Media Executive, whatever your team structure needs. Each custom role gets a specific subset of permissions from the 199 permission keys available in the system. Only permissions the Admin holds and has marked as delegatable can be granted to lower roles. This prevents permission escalation — nobody can give away access they don't have.
199 Permission Keys, Dynamically Assigned
Every API endpoint in LigiComms is protected by a dynamic permission filter. The permission key follows the pattern {Controller}.{Action} — for example, SocialPosts.Create, Wallet.GetBalance, WhatsApp.Send. When a request hits an endpoint, the filter checks whether the user's role has that specific permission key assigned.
This is not hardcoded authorization. There is no [Authorize(Roles = "Admin")] in the codebase. Permissions are data, stored in the database, and can be remapped at runtime via the Roles page. SuperAdmin can reassign any of the 199 keys to any role without deploying code.
For the tenant Admin, the Roles page shows every custom role they've created, with checkboxes for each delegatable permission. Check the box, save, and the role gains that access. Uncheck and save, and it loses it. No restart, no deployment, no "contact support to change your access levels."
Roles are data, not code. Permissions are assigned at runtime, not compiled into the application. This means your team structure can evolve without waiting for a software update.
Staff Management: Invites, Seats, and Lifecycle
Adding a team member starts with an email invite. The invite is quota-gated — your plan's MaxStaff limit (2, 4, or 7 depending on your tier) is enforced at invite time, counting both active members and pending invitations. A pending invite holds a seat.
The Staff page is split into two tabs that reflect the reality that a pending invite is not a team member:
- Team tab — members who accepted the invite. Shows their role, department, status, when they joined, and their last-seen date. Actions: change role, change status (active/inactive), remove.
- Invitations tab — pending and expired invites. Shows who sent the invite, when, and the live state of the accept link. Actions: resend (which invalidates the old link for security) and revoke (which deletes the un-joined row and frees the seat).
The seat counter explains itself: "2 / 4 seats used — 1 joined, 1 invited." No more wondering why the number seems wrong when someone has been invited but hasn't joined yet.
Deactivating a staff member frees their seat without deleting their data. They can be reactivated later without a new invite.
Role Levels: Preventing Unauthorized Escalation
Each role carries a Level (0 to 100). A user can only manage roles with a lower level than their own. SuperAdmin is at level 100, Admin at 50, Manager at 20, Editor at 10, and tenant custom roles at 0.
This level hierarchy prevents a Manager from assigning themselves Admin privileges or creating a custom role with more access than their own. It is a guardrail that most tools skip entirely — and then discover they need when an intern accidentally gets full publishing access.
How Roles Connect to Workflow
The content approval workflow is permission-driven, and those permissions are role-assigned:
Workflow.Submit— can create a draft and send it for review (Editor and above).Workflow.Review— can review submitted posts and request changes (Manager and above).Workflow.Approve— can approve posts (Manager and above).Workflow.Publish— can publish an approved post (Manager and above, plus per-channelCanPublishflag).Workflow.ViewAll— can see the entire team's review queue, not just their own (Admin only).Workflow.Reassign— can reassign a post to a different reviewer (Admin only).
A custom "Senior Editor" role could get Submit, Review, and Approve — but not Publish, keeping final publishing authority with the Manager. The flexibility is granular enough to model real team structures.
What This Costs
Every seat includes full platform access — the features available depend on the role assigned, not the seat price. There is no "viewer" tier at a lower cost, no "admin" tier at a premium. A seat is a seat. What each person can do is controlled by their role, which is configured for free on the Roles page.
Compare this to tools that charge per user per month with features gated by seat type. A three-person team at $25 per admin seat and $10 per viewer seat is already $55 per month — and that's before you add the scheduling tool, the inbox tool, and the CRM. LigiComms gives you all of it — roles, permissions, workflow, publishing, CRM, inbox — for one subscription.
The Bottom Line
Access control is not about locking people out. It is about making sure each person on your team has exactly what they need — no more and no less. An editor who can draft but not publish. A manager who can approve but not change billing. An intern who can view analytics but not touch the wallet.
When your tool makes this easy and included, your team can grow without fear. You don't avoid hiring because "we'd need to upgrade to the enterprise plan for more roles." You add people, assign appropriate access, and keep moving.
Team management for social media should not require an enterprise contract. It should require a checkbox and a save button.