The chat widget — Who can do what

• Only workspace admins can create a Widget view, for the reason forms are admin-only: it is a standing anonymous write endpoint. • A new widget is off until somebody switches it on. • A visitor's credential reads exactly one conversation, and only through the widget it was minted on — a token from one customer's widget can never read a thread through another's. • An email address a visitor supplies is a delivery target and never proof of who they are, so it can't be used to read somebody else's conversation. • Deleting the Widget view retires the endpoint on every site it is embedded on, immediately and permanently; conversations already received are untouched.