Ask AI Access Controls give agency administrators a centralized way to manage how Ask AI is used across sub-accounts and individual users in HighLevel.
Assign access levels, configure skill permissions, and control which AI capabilities are available to different team members. Administrators can also apply changes in bulk and review audit logs to track permission updates. These controls help agencies provide useful AI assistance while protecting sensitive data and operations.
TABLE OF CONTENTS
- What Are Ask AI Access Controls?
- Understanding Ask AI Access Levels
- Understanding Skill Permissions
- How Skill Permissions Interact With HighLevel User Permissions
- Managing Ask AI Capabilities
- Managing Ask AI Access Across Sub-Accounts and Users
- Bulk Access Management
- Tracking Changes With Audit Logs
- How to Set Up Ask AI Access Controls
- Frequently Asked Questions
- Related Articles
What Are Ask AI Access Controls?
Ask AI Access Controls are agency-level settings that determine who can use Ask AI and what actions it can perform on their behalf. Instead of granting everyone the same functionality, agency administrators can configure access according to individual responsibilities, account requirements, and organizational policies.
Ask AI Access Controls combine several management options:
Agency Admin: A centralized area for managing Ask AI access across the agency.
Access Levels: Built-in and custom permission profiles assigned to individual users.
Skill Permissions: Controls that determine which areas and operations Ask AI can access.
Capabilities: Individual features that administrators can enable or disable at the agency, sub-account, or user level.
Bulk Management: Tools for assigning access and enabling Ask AI across multiple sub-accounts.
Audit Logs: A record of permission changes, including previous and updated values.
Ask AI also respects each user's existing HighLevel permissions. Assigning an Ask AI access level does not give a user permission to perform actions they cannot already perform in HighLevel.
Important: Agency administrators retain unrestricted Ask AI access. The Agency admin interface is available only to agency administrators and does not appear within sub-accounts or support mode.
Understanding Ask AI Access Levels
Access levels determine the types of skills and operations Ask AI can perform for an individual user. Agencies can use predefined access levels for common responsibilities or create customized versions for teams that require more specific restrictions.
Built-In Access Levels
HighLevel provides three built-in access levels:
| Access Level | Description | Example Use Case |
|---|---|---|
| Assistant | An access level suited to users who primarily need information and assistance without modifying records. | Front-desk staff retrieving contact or conversation information. |
| Operator | An access level suited to users who need Ask AI to perform permitted operational tasks. | Account managers updating opportunities and sending follow-ups. |
| Builder | An access level designed for users who require broader supported capabilities for their responsibilities. | Team members responsible for configuring and building supported business processes. |
The exact operations available under each level are determined by its permission configuration and the user's existing HighLevel permissions.
Important: Assistant, Operator, and Builder are Ask AI access levels. They do not replace HighLevel's standard Agency Admin, Sub-Account Admin, or User roles.
Custom Access Levels
Custom access levels allow administrators to tailor Ask AI permissions for teams with specialized responsibilities or compliance requirements.
Every custom level starts as a copy of an existing access level. Its permissions cannot exceed those granted by the source level when the custom level is created.
For example, an agency might copy the Operator level to create a custom level called "Account Manager — Restricted Payments." The administrator can then remove access to Payments while preserving the other permitted operational capabilities.
Custom levels can be renamed or archived, but they cannot be permanently deleted. This preserves historical references to access-level configurations and changes.
Understanding Skill Permissions
Skill permissions define which types of HighLevel operations Ask AI can access for a user. These permissions provide finer control than enabling or disabling Ask AI entirely, allowing administrators to permit informational tasks while restricting record changes or sensitive operations.
The Ask AI permission policy covers 58 skill areas and 924 operations organized into 12 groups, including Contacts, Conversations, Payments, Projects, and other functional areas.
Skill Permission Levels
| Permission | What It Means |
|---|---|
| Off | The skill is unavailable to Ask AI for the affected user. |
| View | Ask AI can retrieve or read permitted information without modifying it. |
| Edit | Ask AI can perform permitted modification operations within the skill area. |
| Delete | Ask AI can perform permitted deletion operations where supported, subject to applicable confirmation and permission requirements. |
Administrators can configure the appropriate permission level for supported skill areas.
For example, a front-desk user may need Ask AI to retrieve contact information but should not be able to update or delete contact records. An account manager may require editing permissions for Opportunities without requiring access to Payments.
Important: Setting a skill to Off removes it from the skills made available to Ask AI for that user. Ask AI does not receive the disabled skill and does not reveal or suggest it when responding to an out-of-scope request.
Some skill areas are identified as sensitive or agency-only within the permission policy. Administrators should review these designations before granting broader access.
How Skill Permissions Interact With HighLevel User Permissions
Ask AI access levels do not override existing HighLevel permissions.
When a user requests an action, Ask AI must comply with both the applicable Ask AI access policy and the user's underlying HighLevel permissions.
For example:
A user with Ask AI editing permissions for Contacts but read-only Contacts permissions in HighLevel cannot use Ask AI to modify contact records.
A user with permission to edit Opportunities in HighLevel but only View permission through Ask AI cannot use Ask AI to update opportunities.
A skill configured as Off is not made available to Ask AI for that user, even when the user has broader permissions in HighLevel.
Access policies apply to both Ask AI text and voice interactions. Permission checks prevent unauthorized operations from reaching the underlying CRM.
For more information about standard user permissions, refer to Sub-account: User Roles, Permissions and Assigned Data.
Managing Ask AI Capabilities
Capabilities control whether individual Ask AI features are available, independently of the skill permissions assigned through access levels. These settings let administrators manage feature availability without modifying an entire access-level configuration.
Capability controls can be applied at three scopes:
Agency: Control capability availability across the agency.
Sub-account: Configure availability for a specific sub-account.
User: Control availability for an individual person.
Examples of capabilities include Browser Control and Voice. The release also identifies Dispatch as a capability in the product walkthrough.
For example, an agency can allow account managers to update CRM records through Ask AI while disabling Browser Control for a client with stricter compliance requirements.
Capability controls and skill permissions work together. A user needs both the appropriate access permissions and the required capability availability to use a supported feature.
For additional information about Browser Control setup, refer to AI Browser Control Extension.
Managing Ask AI Access Across Sub-Accounts and Users
Agency administrators can manage Ask AI availability at both the sub-account and individual user level. This makes it possible to enable Ask AI for an entire agency while maintaining different restrictions for specific clients or team members.
Sub-Account Access
Each sub-account can have Ask AI enabled or disabled through its access controls.
An agency may enable Ask AI for most clients while keeping it disabled for sub-accounts that have not yet approved AI-assisted operations.
Individual User Access
Within an enabled sub-account, administrators can manage individual users through Ask AI switches and access-level assignments.
For example, three team members in the same sub-account might receive different configurations:
| User Responsibility | Example Access Configuration |
|---|---|
| Front Desk | Ask AI enabled with Assistant access |
| Account Manager | Ask AI enabled with Operator access |
| Restricted User | Ask AI disabled |
This allows the agency to tailor each person's Ask AI experience without changing the access configurations of unrelated users.
Bulk Access Management
Bulk access management allows administrators to apply Ask AI configurations across multiple sub-accounts without repeating the same operation manually. This is particularly useful for agencies managing large numbers of clients or rolling out standardized access policies.
Supported bulk operations include enabling Ask AI across multiple sub-accounts and applying an access level to users within matching sub-accounts.
Access-level bulk assignments run as background jobs. Administrators can review job progress and history, inspect failed rows, cancel a running job, and retry failed assignments.
Bulk Job Status and Retry
Bulk job tracking provides visibility into the outcome of access-management changes.
Progress: Monitor the current status of the bulk operation.
History: Review previously submitted bulk operations.
Failed Rows: Identify assignments that were not completed successfully.
Cancel: Stop a bulk operation that is still running.
Retry: Run the operation again for failed assignments only, without repeating successful assignments.
For example, an agency with 150 sub-accounts can enable Ask AI across the selected accounts and assign Operator access to account managers using bulk operations.
If some assignments fail, the administrator can inspect the failed rows and retry those assignments instead of starting the entire operation again.
Tracking Changes With Audit Logs
Audit logs provide a record of administrative changes to Ask AI access configurations. These records help agencies investigate unexpected permission changes, review account activity, and maintain accountability for access-management decisions.
Ask AI access-related changes are recorded in Settings → Audit Logs under the Ask AI access category.
The audit trail covers changes to:
Access levels
User access-level assignments
Capability configurations
Entries identify who made the change and include the previous and updated values in the details drawer.
For example, if a client's account manager unexpectedly loses access to a skill, an agency administrator can inspect the relevant Ask AI access events to determine what changed and who performed the update.
Note: HighLevel's general Audit Logs documentation describes a 60-day retention period. Administrators should follow the applicable retention policy and export or otherwise preserve records when their organization's compliance requirements call for longer-term evidence. For more information, refer to Audit Logs.
Frequently Asked Questions
Q: Can an agency administrator restrict their own Ask AI access?
Agency administrators retain unrestricted Ask AI access under the current access-control model. The administrative controls are intended to manage access for other eligible users and sub-accounts.
Q: What happens when someone asks Ask AI to perform an action using a skill that has been turned off?
The disabled skill is not sent to Ask AI as an available skill. Ask AI provides a neutral response when the request cannot be fulfilled within the user's permitted capabilities, without revealing or suggesting hidden skills.
Q: Can a custom access level grant more permissions than the level it was copied from?
No. A custom access level cannot exceed the permissions granted by its source level when it is created.
Q: Can I permanently delete a custom access level?
No. Custom access levels can be renamed or archived, but not permanently deleted. This helps preserve historical access-control information.
Q: If a user has permission to edit Contacts in HighLevel, can they edit Contacts through Ask AI when their Ask AI access is restricted to View?
No. Ask AI respects the more restrictive applicable permissions. The user must have appropriate permissions in both systems to perform the requested action.
Q: Will retrying a failed bulk assignment repeat changes that were already successful?
No. The Retry operation reprocesses failed assignments only, avoiding unnecessary repetition of successful assignments.
Q: Can I disable Browser Control without disabling Ask AI entirely?
Yes. Capability controls allow administrators to disable specific supported features while leaving other permitted Ask AI functionality available.
Q: Does assigning an access level change the user's standard HighLevel role?
No. Ask AI access levels control the user's Ask AI permissions. Standard HighLevel roles and granular permissions remain separate and continue to apply.
Related Articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article