Organizations and permissions
Choose which of your organizations the assistant works in, and see what your roles let it do there.
Your assistant always works inside one of your Lahuta organizations, and it can only do what your roles in that organization allow. This page covers how it picks the organization, how to point it at another one, and what each permission lets it do.
Which organization it uses
If you belong to one organization, the assistant always works there and you never have to name it.
If you belong to more than one, every request has to say which. Lahuta won't guess: a request that names no organization comes back with OrganizationRequired and the list of your organizations, and the assistant asks you or picks the one you named earlier in the chat. The organization you chose while connecting doesn't matter.
Not sure where the assistant is working? Ask it: "Which Lahuta organization are you using?" It checks with the orgs_get tool, which returns the organization's name and slug, and your roles and permissions there.
Name the organization
Every Lahuta tool takes an org setting, the organization's slug or id, and the assistant fills it in when you name the organization:
- "In northside-pottery, list next week's events."
- "Act in northside-pottery for the rest of this chat."
- "Show me upcoming events in each of my organizations."
The slug is the last part of your dashboard address. For lahuta.org/dash/northside-pottery, it's northside-pottery. You can also ask "Which Lahuta organizations am I in?" and the assistant lists them with the users_orgs_list tool, most recently opened first.
The choice applies call by call. If an answer looks like it came from the wrong place, ask the assistant which organization it used for that step.
Only your own organizations
The assistant can reach an organization only if you're a member of it. Naming one you're not in, or a slug that doesn't exist, gets the same "not found" answer, so the reply never reveals whether an organization exists.
Roles and permissions
Your roles in each organization decide what the assistant can do there. A role is a set of permissions, and every organization has two built in:
- Admin has every permission on this page.
- Member works with your customers and your marketing. Members can use contacts, the inbox, campaigns, the newsletter and workflows, including sending and publishing. They can look at events, products, orders, services and blog posts but not change them. They can't use bookings, social posts or payments, and can't change your settings.
Your organization can have roles of its own too. A person can hold more than one role, and then has every permission any of those roles gives. The same person can be an admin at one studio and a member at another, and the assistant follows the roles they hold in whichever organization it's working in.
Each permission is named area:action. read lets you look, and write lets you add, change and delete. write and manage always include read for the same area. A few actions that reach many people, move money or go live have a permission of their own, so a role can draft a campaign without being able to send it.
Permissions apply everywhere in Lahuta, not only to the assistant, so this table also covers things the assistant has no tools for, like members and API keys.
| Permission | What it covers | Admin | Member |
|---|---|---|---|
contacts:read | Looking up contacts, their timelines, groups, notes and reminders. | Yes | Yes |
contacts:write | Adding, changing, archiving and merging contacts, and changing groups, notes and reminders. | Yes | Yes |
inbox:read | Reading inbox threads. | Yes | Yes |
inbox:write | Sending chats, texts and emails from the inbox, and closing and assigning threads. | Yes | Yes |
campaigns:read | Looking at campaigns, their audiences and stats, the addresses they can come from, and templates. | Yes | Yes |
campaigns:write | Drafting, changing and cancelling campaigns, saving and deleting templates, and editing the Do not email list. | Yes | Yes |
campaigns:send | Sending a campaign, now or at a set time. | Yes | Yes |
newsletter:read | Looking at newsletter topics, subscribers and editions. | Yes | Yes |
newsletter:write | Adding topics, signing people up or taking them off, and drafting and cancelling editions. | Yes | Yes |
newsletter:send | Sending an edition to subscribers, now or later. | Yes | Yes |
events:read | Looking at events, tickets, registrations, requests, event messages, co-hosts and insights. | Yes | Yes |
events:write | Creating, changing and deleting events and everything on them: dates, tickets, guests, approvals, event messages, co-hosts and registration forms. | Yes | No |
events:checkin | Finding guests at the door and checking them in. | Yes | No |
bookings:read | Looking at booking pages, open times and bookings. | Yes | No |
bookings:write | Creating and changing booking pages, and booking, rescheduling, assigning, marking and cancelling bookings. | Yes | No |
products:read | Looking at products, collections and coupons. | Yes | Yes |
products:write | Creating and changing products, variants, photos, collections and coupons. | Yes | No |
orders:read | Looking at shop orders and service orders. | Yes | Yes |
orders:write | Fulfilling and cancelling shop orders, and delivering service work. | Yes | No |
orders:refund | Giving money back: a refund when you cancel a registration or a shop order, and cancelling a service order, which always refunds. | Yes | No |
services:read | Looking at services, their tiers and custom offers. | Yes | Yes |
services:write | Creating and changing services and tiers, and writing, sending and withdrawing custom offers. | Yes | No |
blog:read | Looking at blog posts, their SEO checks and keywords. | Yes | Yes |
blog:write | Writing, publishing, unpublishing, reviewing and deleting blog posts. | Yes | No |
social:read | Looking at connected social accounts, social posts and their stats. | Yes | No |
social:write | Connecting social accounts, and drafting, cancelling and deleting social posts. | Yes | No |
social:publish | Publishing a social post, now or at a set time. | Yes | No |
workflows:read | Looking at workflows, their runs and stats. | Yes | Yes |
workflows:write | Creating, changing, copying, archiving and deleting workflows, and stopping runs. | Yes | Yes |
workflows:publish | Publishing a workflow, resuming a paused one, and starting contacts in it. | Yes | Yes |
payments:read | Checking whether Stripe is connected and ready to take payments. | Yes | No |
payments:manage | Connecting and disconnecting Stripe. | Yes | No |
settings:manage | Changing organization settings, the Express Page, connected mailboxes and text messaging settings, and recording text consent. | Yes | No |
members:manage | Inviting people, changing their roles and removing them. | Yes | No |
api-keys:manage | Creating and revoking API keys. | Yes | No |
A few things stand out for members. They can see events, products, orders, services and blog posts through the assistant, but not change them, and they can't check guests in. Bookings and social posts are off limits, even to look at. And members can send campaigns and newsletter editions and publish workflows, since the member role includes campaigns:send, newsletter:send and workflows:publish.
Some tools add a rule of their own:
- Only the person who wrote a note can edit or delete it, whatever their roles.
- Cancelling a registration or a shop order with a refund also needs
orders:refund. - A form follows what it belongs to. An event's registration form needs
events:readto read andevents:writeto change, and a booking page's questions needbookings:readandbookings:write.
The Tools reference lists the permission each tool needs.
When your roles don't allow something
If the assistant tries a tool your roles don't cover, Lahuta refuses it and changes nothing. The assistant gets an error with the reason Forbidden and the missing permission, and a good assistant tells you so rather than guessing.
| The assistant reports | What it means | What to do |
|---|---|---|
Forbidden with a permission like events:write | None of your roles in that organization includes it. | Ask an admin to do it, or to give you a role that includes it. |
Forbidden with bookings:read | Your roles don't include bookings at all, not even looking at them. | Ask an admin to look it up, or to give you a role that includes bookings. |
Forbidden with note:author | Someone else wrote that note. | Only the note's author can edit or delete it. Ask them, or add a new note. |
NotFound for resource: organization | The slug or id is wrong, or you're not a member of that organization. | Check the slug in your dashboard address, or ask for your list of organizations. |
OrganizationRequired | You belong to several organizations and the request named none. | Tell the assistant which organization to work in. |
Lahuta checks your roles on every call, not only when you connect. When an admin changes your roles, the assistant follows them without you reconnecting. Roles are managed under Settings → Members, as described in Invite your team.