| name | intercom-enterprise-rbac |
| description | Configure Intercom enterprise OAuth, admin roles, and app-level access control.
Use when implementing OAuth integration, managing admin permissions, or setting
up organization-level controls for Intercom — e.g. gating a delete endpoint by
role, installing a public app for a customer workspace, or adding admin audit
logging.
Trigger with phrases like "intercom OAuth", "intercom RBAC", "intercom
enterprise", "intercom roles", "intercom permissions", "intercom admin access".
|
| allowed-tools | Read, Write, Edit |
| version | 1.6.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","support","messaging","intercom"] |
| compatibility | Designed for Claude Code |
Intercom Enterprise RBAC
Overview
Configure enterprise-grade access control for Intercom integrations with OAuth
scopes, admin role management, and app-level permission enforcement.
The workflow covers the full path: enumerate the workspace's admins and teams,
authorize a public app with least-privilege scopes, enforce per-operation
permissions at the application layer, route conversations to teams, and audit
sensitive admin actions.
The high-level workflow lives here; complete, copy-ready code for every step is in
references/implementation.md, and end-to-end
scenarios are in references/examples.md.
Prerequisites
- Intercom workspace with admin access
- Understanding of OAuth 2.0 flows
- For public apps: OAuth configured in Developer Hub
intercom-client installed and INTERCOM_ACCESS_TOKEN (or OAuth client
credentials) available in the environment
Intercom Admin Roles
Intercom has built-in admin roles that control workspace access:
| Role | API Access | Capabilities |
|---|
| Owner | Full | All operations, billing, workspace settings |
| Admin | Full | Manage contacts, conversations, content |
| Agent | Limited | Reply to conversations, view contacts |
| Custom roles | Configurable | Enterprise plan feature |
These built-in roles govern access inside the Intercom UI and API. Map them onto
explicit permissions (Step 3) rather than trusting the role name alone.
Instructions
Follow the five steps in order. Each step's full code is in
references/implementation.md under the matching
heading — the skeletons below show the essential call surface.
Step 1: List admins and roles
Enumerate every admin and team to map real identities to permissions.
const client = ({ : process..! });
adminList = client..();
