RBAC + Multi-User Dashboards: CallSphere vs Vapi Single-Tenant

TL;DR

Voice AI is not a single-engineer tool — it's an operations platform used by managers, supervisors, agents, compliance officers, and execs. CallSphere ships RBAC across every vertical: admin/staff for healthcare, admin/manager/sales_rep for sales, Admin/Agent/Requester for IT helpdesk, with audit_logs and per-role dashboards. Vapi.ai is a developer-first platform with no native non-tech UI for ops staff. This post walks through the role permission matrix, shows the dashboards, and gives you a procurement checklist.

Why Single-Tenant Dev UI Doesn't Scale

A first deployment of a voice AI tool typically has one developer who can read transcripts, change prompts, and view costs. Six months in, the deployment has:

A clinical manager who needs to see appointment KPIs but not raw transcripts
A compliance officer who needs audit-only access
A sales manager who needs team performance dashboards
Front-desk staff who need only their own queue
A billing team who needs cost & usage reports
Execs who need a high-level rollup

If the platform only offers a developer console, the customer either:

Grants too much access (compliance risk)
Builds a custom dashboard layer (engineering tax)
Lives with operational friction (ops never adopt the system)

CallSphere ships per-vertical RBAC out of the box so the cluster of roles above maps to product roles directly.

CallSphere RBAC by Vertical

Healthcare

Admin — full access including raw transcripts, audit logs, billing
Staff — appointments, patient registry view, dashboard analytics, no raw transcript replay

Sales

Admin — full access including settings, user management
Manager — team performance dashboards, queue config, call monitoring, coaching tools
Sales Rep — own calls, own metrics, lead pipeline view

Salon

Admin — full access including audit_logs
Manager — appointments, agent_interactions, daily_metrics
Staff — operational view only

After-Hours

Admin — escalation_logs, admin_alerts, daily_metrics
Operator — events queue, escalation handling

IT Helpdesk

Admin — full access including ai_usage_logs, daily_metrics
Agent — assigned tickets, knowledge base
Requester — own ticket history

Vapi's Single-Tenant Console

Vapi's platform is a developer console: API keys, agent configs, call logs. There is no native non-tech UI for ops:

No multi-role dashboards
No team-scoped views
No audit log of UI actions
No per-agent role separation
No native CRM-style call queue UI

To support an ops team, the customer typically:

Builds a custom Next.js / React dashboard
Wires authentication (Auth0, Clerk, etc.)
Implements RBAC at the API layer
Connects to Vapi data via webhooks / API
Builds and maintains every role's view
Audit-logs UI actions

This is a multi-month engineering project on top of the voice AI itself.

Mermaid: Role Permission Matrix

graph TB
  subgraph Healthcare
    HCA[Admin] -->|view| HCAUDIT[audit_logs]
    HCA -->|view| HCRAW[raw transcripts]
    HCA -->|view| HCDASH[dashboards]
    HCS[Staff] -->|view| HCDASH
    HCS -->|view| HCAPPT[appointments]
    HCS -.no.-x HCRAW
  end
  subgraph Sales
    SA[Admin] -->|view| SAUDIT[audit_logs]
    SA -->|view| SDASH[real-time dashboards]
    SM[Manager] -->|view| SDASH
    SM -->|coach| SREP[Sales Rep]
    SREP -->|view| SOWNCALLS[own calls]
    SREP -.no.-x SAUDIT
  end
  subgraph IT[IT Helpdesk]
    ITA[Admin] -->|view| ITUSAGE[ai_usage_logs]
    ITAG[Agent] -->|view| ITASSIGN[assigned tickets]
    ITREQ[Requester] -->|view| ITOWN[own tickets]
  end

The matrix gives compliance officers a defensible "least privilege" answer for every dashboard view.

Comparison Table

RBAC Capability	Vapi DIY	CallSphere
Per-role dashboards	Build yourself	Built-in
Healthcare admin/staff split	Build yourself	Default
Sales admin/manager/rep	Build yourself	Default
IT Admin/Agent/Requester	Build yourself	Default
Audit log of UI actions	Build yourself	Default
Team-scoped views	Build yourself	Default
Coaching / call monitoring tools	Build yourself	Sales vertical
SSO / SAML	Build yourself	Available
Time-to-ops-ready	Months	Day 1

What Each Role Actually Does

Healthcare Admin: configures schedules, manages providers, reviews escalations, audits transcripts under BAA-controlled access, exports compliance evidence.

Healthcare Staff: views the day's appointments, the patient registry, dashboard KPIs (calls answered, no-shows, lead conversions). Cannot replay raw recordings or read full transcripts.

Sales Manager: monitors live calls in the WebSocket dashboard, coaches reps with whisper / barge tools, reviews call_metrics and sales_rep_metrics, tunes routing rules.

Sales Rep: sees own queue, own conversion metrics, own coaching history. Cannot see other reps' raw calls.

IT Admin: reviews ai_usage_logs (cost, throughput), manages knowledge base, sets up routing.

IT Requester: opens tickets, tracks own ticket status, sees own history.

The role split is the difference between a tool an engineer demos and a platform an operations org actually uses.

Procurement-Friendly RBAC Checklist

Are roles defined per vertical out of the box?
Can roles be tuned via config, or do they require code changes?
Are UI actions audit-logged with user, action, target, timestamp?
Is SSO / SAML supported?
Are JWT tokens scoped per role with short expiry?
Are sensitive views (raw transcripts) gated by elevated roles?
Are team-scoped views supported (manager sees team, rep sees self)?
Are coaching / call monitoring tools available where applicable?
Are role definitions in scope for SOC 2 / HIPAA?
Is multi-tenancy enforced at the database row level?

Real-World Adoption Pattern

A 200-person services company piloted a Vapi-based intake bot with one developer. After six months:

See AI Voice Agents Handle Real Calls

Book a free demo or calculate how much you can save with AI voice automation.

Try Live Demo ROI Calculator

Ops team never logged in (no UI)
Compliance flagged the developer-only access as a finding
Manager-level reporting was a manual CSV export
Onboarding a new role meant a new endpoint deploy

Migration to CallSphere included role provisioning for 14 staff across 3 roles in the first week. Adoption became operational, not engineering.

CTA

Voice AI is an operations platform — and operations need roles. Book a CallSphere demo and walk through the multi-role dashboard, or check pricing.

FAQ

Are roles configurable beyond the defaults?

Yes. Each vertical's defaults can be extended with custom roles via configuration. Permissions are expressed as scopes that map to API routes and UI components.

Is SSO supported?

Yes. SAML SSO and OIDC are available on enterprise plans, with role mapping from IdP groups.

Are UI actions audit-logged?

Yes. The audit_logs table captures every privileged UI action with user_id, action_type, target, IP, and timestamp.

Can a manager see other teams' data?

Manager views are team-scoped by default. Cross-team views require admin role or explicit grant, which is logged.

Does this cover voice agent configuration changes?

Yes — prompt updates, routing changes, and agent config edits are all audit-logged with diff and committer.

Deep Dive: Permission Scopes

CallSphere's RBAC is scope-based. Each role is composed of one or more scopes:

Scope	Description
transcripts:read:raw	View raw transcripts and listen to recordings
transcripts:read:redacted	View redacted transcripts only
analytics:read	View dashboards and analytics
analytics:export	Export analytics data
audit:read	View audit logs
users:manage	Add / remove users, change roles
settings:write	Change tenant configuration
billing:read	View billing and usage
coaching:write	Whisper / barge / annotate calls
crm:webhook	Manage CRM integration

Roles are bundles of scopes. Admin has all scopes; Manager has analytics:read + coaching:write + transcripts:read:redacted; Rep has transcripts:read:raw scoped to own_calls only.

Tenant Isolation

Multi-tenancy is enforced at three layers:

Database row-level — every PHI / customer record carries a tenant_id, and queries filter by tenant via row-level security or application-layer enforcement
API authorization — JWT carries tenant_id; cross-tenant API calls return 403
UI session scoping — each user session is bound to a tenant; tenant switching requires re-auth

A bug at any layer would be a serious finding, so all three are tested in CI.

Audit Log Schema

The audit_logs table captures:

event_id (UUID)
tenant_id
user_id
action_type (login, view_transcript, change_role, export, etc.)
target_resource_id
target_resource_type
ip_address
user_agent
timestamp
outcome (success / failure)
additional_metadata (JSONB)

Logs are append-only with no UPDATE / DELETE permissions for any application role. This satisfies HIPAA's tamper-evident audit log requirement.

SSO and SAML

Enterprise customers commonly integrate SSO via SAML or OIDC:

Okta, Azure AD, Google Workspace, OneLogin, Auth0 all supported
IdP groups map to CallSphere roles
Just-in-time (JIT) provisioning available
SCIM provisioning for user lifecycle management
Session timeout and idle timeout configurable

For Vapi-based stacks, the customer must build SSO integration into their custom dashboard, plus handle role mapping, provisioning, and session management.

MFA

MFA is required for admin roles by default. Options:

TOTP (Google Authenticator, Authy)
WebAuthn / FIDO2 hardware keys
SMS (deprecated but available for legacy)
Push notification via authenticator apps

Admin actions can require step-up MFA — e.g., changing a billing setting or exporting sensitive data prompts a fresh MFA challenge regardless of session age.

Coaching Tools (Sales)

Manager-level coaching features:

Live monitor — Listen to a live call without participating
Whisper — Speak to the rep without the caller hearing
Barge — Join the call audibly to assist
Tag for review — Flag a call for post-call coaching session
Annotation — Add notes at specific timestamps in the recording
Call card — Quick view of caller history and prior interactions

These features are scoped to the manager's team only — managers can't barge into another team's calls without admin grant.

Dashboard Catalog by Role

Healthcare admin dashboards:

Daily call volume + answered / missed
Appointment funnel (booked / no-show / canceled)
Patient registry (new / returning)
Provider directory
Audit log viewer
Compliance reports (consent rate, NPP ack rate)

Healthcare staff dashboards:

Today's appointments
Patient lookup
Daily KPIs
Notes / tasks

Sales admin dashboards:

Real-time call queue
Team performance
Pipeline by score band
Source attribution
Conversion funnel

Sales manager dashboards:

Team queue
Live call monitor
Coaching flag list
Rep scorecards

Sales rep dashboards:

Personal queue
Personal metrics
Lead pipeline
Coaching feedback

Onboarding Roles

The typical role provisioning flow:

Admin invites user via dashboard
Email sent with magic link or SAML redirect
User completes profile + MFA setup
Role assigned (default by IdP group, customizable per user)
Audit log entry for new user creation
New user has access to scoped dashboards immediately

This is operations-team friendly. A Vapi-based custom dashboard typically requires a developer to provision new users.

Why Operations Adoption Matters

The single best predictor of voice AI ROI is whether the operations team uses the tool. A voice AI that only the developer touches will:

Not be tuned over time
Not catch bad agent behavior early
Not surface insights to managers
Not earn its keep

A voice AI with multi-role dashboards and operational adoption:

Improves quarterly through feedback loops
Catches issues in days, not months
Drives data-informed decisions across functions
Becomes a strategic asset, not a science project

That's why RBAC + dashboards aren't a "nice to have" — they're the difference between a demo and a deployment.