Understand portal ownership isolation
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
A contact cannot request another contact’s verified conversation by changing the URL ID.
Where to goClient Area → WhatsApp History
Before you start
- Verify the module is active and select the intended WhatsApp account before changing any operational record.
- Use an account with the stated native CRM capability and per-account access.
- Test with controlled customer/contact data before relying on live verification, email or CRM automation.
What this guide helps you do
A contact cannot request another contact’s verified conversation by changing the URL ID. These instructions follow the supplied r20.5 controller, model, view, installer, connector and automation flow.
Follow these steps
- Go to Client Area → WhatsApp History.
- Find the account, conversation, setting, session or evidence relevant to “Understand portal ownership isolation”.
- Check the displayed value or behaviour against this guide’s code-backed rules.
- Do not change unrelated account, CRM or connector settings while verifying the result.
- Verify the expected state in the related Inbox, Connections, customer history, native CRM record or Audit Trail.
Fields and options
Portal conversation listPortal conversation list
Selected conversation IDSelected conversation ID
Before-message ID for older messagesBefore-message ID for older messages
Protected media downloadProtected media download
Rules and limits
- Portal history is contact-owned and includes only conversations verified to the signed-in contact.
- The administrator customer tab appears only when the customer has verified conversations visible through the staff member’s accessible accounts.
- Media downloads are routed through authorised controllers and recorded in the session/audit evidence.
- A contact cannot request another contact’s verified conversation by changing the URL ID.
Check it worked
- The requested action completes without a permission, validation, connector or native CRM error.
- The selected account or conversation shows the expected state without changing another account’s data.
- Where the action creates evidence, confirm the message, native record, verification event, portal history or audit entry is present.
Security, privacy and troubleshooting checks
- Never expose connector tokens, loopback ports, authentication directories or raw customer verification replies.
- Use the supported Connections, Access Control, Settings and Audit Trail pages rather than editing runtime or database records directly.
- If the expected control is missing, verify both native capability and per-account permission before treating it as an installation fault.
Related guides
Was this guide useful?Your response is stored only in this browser.