I
Ido Havazelet
PROBLEM
Ask AI can create, edit and delete across most of the platform, but it does not check the user's role permissions. The only gating today is the access tier (agency vs. sub-account, and plan). A client who is blocked from a feature in the UI can still prompt Ask AI to do it, so agencies cannot safely give clients access to Ask AI. Related posts: "WE NEED PERMISSIONS!" and "Ask AI: Permission settings | Allow ASK AI to make edits / changes". This post proposes a concrete spec.
REAL EXAMPLES WITH ASK AI TODAY
  • A user without Calendar access asks Ask AI to delete a calendar or add blocked slots.
  • A user without permission to send bulk messages asks it to send or schedule an SMS/email campaign to contacts.
  • A user without pipeline edit rights asks it to change stages or opportunity values. This breaks third-party integrations that depend on the pipeline structure.
  • A user without Payments access asks it to create invoices, coupons or products.
  • A user without Settings access asks it to create users, buy phone numbers or change custom fields.
  • A user without Funnels access asks it to generate a funnel.
PROPOSED SOLUTION
  1. Enforcement: every Ask AI action is checked server-side against the requesting user's role, at the tool-execution layer and not only in the prompt (prompt-level blocking can be bypassed). If the user lacks permission, Ask AI replies: "You don't have permission to do this. Contact your agency admin."
  2. Ask AI Capabilities panel (agency level): a settings page with an on/off toggle per Ask AI capability group (Calendars, Conversations/Messaging, Pipelines, Payments, Ad Manager, Funnels, Courses, AI Agents, Settings/Admin). Effective access = main role permission AND Ask AI toggle, so Ask AI can never exceed the user's role. A toggle is locked or hidden when the user's main permission is off.
  3. Future-proofing: every new permission and every new Ask AI capability automatically gets its own toggle. New capabilities default to off until the admin enables them.
  4. Optional: a read-only mode, where Ask AI can read and analyze but cannot write.
EXPECTED OUTCOME
Role permissions behave the same whether a user clicks or prompts. Agencies can roll out Ask AI to clients with a defined scope and protect their snapshots and integrations.