RBAC + Multi-User Dashboards: CallSphere vs Vapi Single-Tenant

TL;DR

Voice AI is not a single-engineer tool — it's an operations platform used by managers, supervisors, agents, compliance officers, and execs. CallSphere ships RBAC across every vertical: admin/staff for healthcare, admin/manager/sales_rep for sales, Admin/Agent/Requester for IT helpdesk, with audit_logs and per-role dashboards. Vapi.ai is a developer-first platform with no native non-tech UI for ops staff. This post walks through the role permission matrix, shows the dashboards, and gives you a procurement checklist.

Why Single-Tenant Dev UI Doesn't Scale

A first deployment of a voice AI tool typically has one developer who can read transcripts, change prompts, and view costs. Six months in, the deployment has:

• A clinical manager who needs to see appointment KPIs but not raw transcripts
• A compliance officer who needs audit-only access
• A sales manager who needs team performance dashboards
• Front-desk staff who need only their own queue
• A billing team who needs cost & usage reports
• Execs who need a high-level rollup

If the platform only offers a developer console, the customer either:

• Grants too much access (compliance risk)
• Builds a custom dashboard layer (engineering tax)
• Lives with operational friction (ops never adopt the system)

CallSphere ships per-vertical RBAC out of the box so the cluster of roles above maps to product roles directly.

CallSphere RBAC by Vertical

Healthcare

• Admin — full access including raw transcripts, audit logs, billing
• Staff — appointments, patient registry view, dashboard analytics, no raw transcript replay

Sales

• Admin — full access including settings, user management
• Manager — team performance dashboards, queue config, call monitoring, coaching tools
• Sales Rep — own calls, own metrics, lead pipeline view

Salon

• Admin — full access including audit_logs
• Manager — appointments, agent_interactions, daily_metrics
• Staff — operational view only

After-Hours

• Admin — escalation_logs, admin_alerts, daily_metrics
• Operator — events queue, escalation handling

IT Helpdesk

• Admin — full access including ai_usage_logs, daily_metrics
• Agent — assigned tickets, knowledge base
• Requester — own ticket history

Vapi's Single-Tenant Console

Vapi's platform is a developer console: API keys, agent configs, call logs. There is no native non-tech UI for ops:

• No multi-role dashboards
• No team-scoped views
• No audit log of UI actions
• No per-agent role separation
• No native CRM-style call queue UI

To support an ops team, the customer typically:

1. Builds a custom Next.js / React dashboard
2. Wires authentication (Auth0, Clerk, etc.)
3. Implements RBAC at the API layer
4. Connects to Vapi data via webhooks / API
5. Builds and maintains every role's view
6. Audit-logs UI actions

This is a multi-month engineering project on top of the voice AI itself.

Mermaid: Role Permission Matrix

graph TB
 subgraph Healthcare
 HCA[Admin] -->|view| HCAUDIT[audit_logs]
 HCA -->|view| HCRAW[raw transcripts]
 HCA -->|view| HCDASH[dashboards]
 HCS[Staff] -->|view| HCDASH
 HCS -->|view| HCAPPT[appointments]
 HCS -.no.-x HCRAW
 end
 subgraph Sales
 SA[Admin] -->|view| SAUDIT[audit_logs]
 SA -->|view| SDASH[real-time dashboards]
 SM[Manager] -->|view| SDASH
 SM -->|coach| SREP[Sales Rep]
 SREP -->|view| SOWNCALLS[own calls]
 SREP -.no.-x SAUDIT
 end
 subgraph IT[IT Helpdesk]
 ITA[Admin] -->|view| ITUSAGE[ai_usage_logs]
 ITAG[Agent] -->|view| ITASSIGN[assigned tickets]
 ITREQ[Requester] -->|view| ITOWN[own tickets]
 end

The matrix gives compliance officers a defensible "least privilege" answer for every dashboard view.

Comparison Table

RBAC Capability	Vapi DIY	CallSphere
Per-role dashboards	Build yourself	Built-in
Healthcare admin/staff split	Build yourself	Default
Sales admin/manager/rep	Build yourself	Default
IT Admin/Agent/Requester	Build yourself	Default
Audit log of UI actions	Build yourself	Default
Team-scoped views	Build yourself	Default
Coaching / call monitoring tools	Build yourself	Sales vertical
SSO / SAML	Build yourself	Available
Time-to-ops-ready	Months	Day 1

What Each Role Actually Does

Healthcare Admin: configures schedules, manages providers, reviews escalations, audits transcripts under BAA-controlled access, exports compliance evidence.

Healthcare Staff: views the day's appointments, the patient registry, dashboard KPIs (calls answered, no-shows, lead conversions). Cannot replay raw recordings or read full transcripts.

Sales Manager: monitors live calls in the WebSocket dashboard, coaches reps with whisper / barge tools, reviews call_metrics and sales_rep_metrics, tunes routing rules.

Sales Rep: sees own queue, own conversion metrics, own coaching history. Cannot see other reps' raw calls.

IT Admin: reviews ai_usage_logs (cost, throughput), manages knowledge base, sets up routing.

IT Requester: opens tickets, tracks own ticket status, sees own history.

The role split is the difference between a tool an engineer demos and a platform an operations org actually uses.

Procurement-Friendly RBAC Checklist

1. Are roles defined per vertical out of the box?
2. Can roles be tuned via config, or do they require code changes?
3. Are UI actions audit-logged with user, action, target, timestamp?
4. Is SSO / SAML supported?
5. Are JWT tokens scoped per role with short expiry?
6. Are sensitive views (raw transcripts) gated by elevated roles?
7. Are team-scoped views supported (manager sees team, rep sees self)?
8. Are coaching / call monitoring tools available where applicable?
9. Are role definitions in scope for HIPAA?
10. Is multi-tenancy enforced at the database row level?

Real-World Adoption Pattern

A 200-person services company piloted a Vapi-based intake bot with one developer. After six months:

• Ops team never logged in (no UI)
• Compliance flagged the developer-only access as a finding
• Manager-level reporting was a manual CSV export
• Onboarding a new role meant a new endpoint deploy

Migration to CallSphere included role provisioning for 14 staff across 3 roles in the first week. Adoption became operational, not engineering.

CTA

Voice AI is an operations platform — and operations need roles. Book a CallSphere demo and walk through the multi-role dashboard, or check pricing.

FAQ

Are roles configurable beyond the defaults?

Yes. Each vertical's defaults can be extended with custom roles via configuration. Permissions are expressed as scopes that map to API routes and UI components.

Is SSO supported?

Yes. SAML SSO and OIDC are available on enterprise plans, with role mapping from IdP groups.

Are UI actions audit-logged?

Yes. The audit_logs table captures every privileged UI action with user_id, action_type, target, IP, and timestamp.

Can a manager see other teams' data?

Manager views are team-scoped by default. Cross-team views require admin role or explicit grant, which is logged.

Does this cover voice agent configuration changes?

Yes — prompt updates, routing changes, and agent config edits are all audit-logged with diff and committer.

Deep Dive: Permission Scopes

CallSphere's RBAC is scope-based. Each role is composed of one or more scopes:

Scope	Description
transcripts:read:raw	View raw transcripts and listen to recordings
transcripts:read:redacted	View redacted transcripts only
analytics:read	View dashboards and analytics
analytics:export	Export analytics data
audit:read	View audit logs
users:manage	Add / remove users, change roles
settings:write	Change tenant configuration
billing:read	View billing and usage
coaching:write	Whisper / barge / annotate calls
crm:webhook	Manage CRM integration

Roles are bundles of scopes. Admin has all scopes; Manager has analytics:read + coaching:write + transcripts:read:redacted; Rep has transcripts:read:raw scoped to own_calls only.

Tenant Isolation

Multi-tenancy is enforced at three layers:

1. Database row-level — every PHI / customer record carries a tenant_id, and queries filter by tenant via row-level security or application-layer enforcement
2. API authorization — JWT carries tenant_id; cross-tenant API calls return 403
3. UI session scoping — each user session is bound to a tenant; tenant switching requires re-auth

A bug at any layer would be a serious finding, so all three are tested in CI.

Audit Log Schema

The audit_logs table captures:

• event_id (UUID)
• tenant_id
• user_id
• action_type (login, view_transcript, change_role, export, etc.)
• target_resource_id
• target_resource_type
• ip_address
• user_agent
• timestamp
• outcome (success / failure)
• additional_metadata (JSONB)

Logs are append-only with no UPDATE / DELETE permissions for any application role. This satisfies HIPAA's tamper-evident audit log requirement.

SSO and SAML

Enterprise customers commonly integrate SSO via SAML or OIDC:

• Okta, Azure AD, Google Workspace, OneLogin, Auth0 all supported
• IdP groups map to CallSphere roles
• Just-in-time (JIT) provisioning available
• SCIM provisioning for user lifecycle management
• Session timeout and idle timeout configurable

For Vapi-based stacks, the customer must build SSO integration into their custom dashboard, plus handle role mapping, provisioning, and session management.

MFA

MFA is required for admin roles by default. Options:

• TOTP (Google Authenticator, Authy)
• WebAuthn / FIDO2 hardware keys
• SMS (deprecated but available for legacy)
• Push notification via authenticator apps

Admin actions can require step-up MFA — e.g., changing a billing setting or exporting sensitive data prompts a fresh MFA challenge regardless of session age.

Coaching Tools (Sales)

Manager-level coaching features:

• Live monitor — Listen to a live call without participating
• Whisper — Speak to the rep without the caller hearing
• Barge — Join the call audibly to assist
• Tag for review — Flag a call for post-call coaching session
• Annotation — Add notes at specific timestamps in the recording
• Call card — Quick view of caller history and prior interactions

These features are scoped to the manager's team only — managers can't barge into another team's calls without admin grant.

Dashboard Catalog by Role

Healthcare admin dashboards:

• Daily call volume + answered / missed
• Appointment funnel (booked / no-show / canceled)
• Patient registry (new / returning)
• Provider directory
• Audit log viewer
• Compliance reports (consent rate, NPP ack rate)

Healthcare staff dashboards:

• Today's appointments
• Patient lookup
• Daily KPIs
• Notes / tasks

Sales admin dashboards:

• Real-time call queue
• Team performance
• Pipeline by score band
• Source attribution
• Conversion funnel

Sales manager dashboards:

• Team queue
• Live call monitor
• Coaching flag list
• Rep scorecards

Sales rep dashboards:

• Personal queue
• Personal metrics
• Lead pipeline
• Coaching feedback

Onboarding Roles

The typical role provisioning flow:

1. Admin invites user via dashboard
2. Email sent with magic link or SAML redirect
3. User completes profile + MFA setup
4. Role assigned (default by IdP group, customizable per user)
5. Audit log entry for new user creation
6. New user has access to scoped dashboards immediately

This is operations-team friendly. A Vapi-based custom dashboard typically requires a developer to provision new users.

Why Operations Adoption Matters

The single best predictor of voice AI ROI is whether the operations team uses the tool. A voice AI that only the developer touches will:

• Not be tuned over time
• Not catch bad agent behavior early
• Not surface insights to managers
• Not earn its keep

A voice AI with multi-role dashboards and operational adoption:

• Improves quarterly through feedback loops
• Catches issues in days, not months
• Drives data-informed decisions across functions
• Becomes a strategic asset, not a science project

That's why RBAC + dashboards aren't a "nice to have" — they're the difference between a demo and a deployment.