Scope and limitations of ABAC for conversations

AI-generated summary

Genesys Cloud combines Attribute-Based Access Control (ABAC) with Role-Based Access Control (RBAC) and divisions to provide granular access management through Boolean logic evaluation of user, resource, and environmental attributes. The system operates on a default-deny principle where DENY policies override ALLOW policies, and access is granted only when users satisfy ALLOW policy conditions, possess necessary permissions, and do not match any DENY policies. ABAC policies target specific API calls using domain:entity:action syntax and apply to defined user subsets through four core components: Target (the resource and action being performed), Subject (the user, group, or OAuth client to which the policy applies), Effect (ALLOW or DENY determination), and optional Conditions (specific criteria using JSON-formatted attribute comparisons). Authorization requires both ABAC policy evaluation and traditional permission verification using JSON-based conditional logic with Any/OR and All/AND operators. Policies are evaluated sequentially, with DENY policies immediately blocking access regardless of matching ALLOW policies, and access denied by default if a resource has attached policies but the user matches no conditions. Preset Attributes enable static value comparisons through TypedAttribute objects with strict naming conventions supporting only alphanumeric characters, periods, and underscores. Each preset attribute entry contains a key representing the attribute name and a value consisting of a TypedAttribute object with type (specifying the basic data type) and value (providing a string representation) members. Validation prevents conflicts with existing system attributes. Genesys Cloud provides four pre-built policy templates for common use cases: gamification scorecard access control limiting supervisor visibility to agents within three reporting hierarchy levels, IP address-based access restrictions, time-frame-based access control, and role assignment prevention for non-admin users. Only one policy per target-subject combination is permitted; additional conditions must be added to existing policies rather than creating duplicates. ABAC operates alongside existing role-based access controls rather than replacing them, requiring final permission verification before resource access is granted.

Review what attribute-based access control (ABAC), customer access attributes, and search restriction cover for conversations, and what continues to use existing access controls.

ABAC coverage

ABAC enforcement and search restriction apply to:

Conversation records
Recordings
Transcripts and transcript content
Quality management evaluations
Forms and surveys
In-scope search experiences and APIs associated with these resources

The same restrictions apply across the Genesys Cloud user interface and in-scope public APIs, so restrictions in the user interface match restrictions for programmatic access. For more information, see ABAC policy targets for conversation resources.

ABAC restrictions

The following continue to be governed by existing role-based and division-based controls.

Feature	Details
External contacts and cases	ABAC and search restriction do not apply to external contact records or Case Management objects.
Calling lists	Calling lists continue to use existing permissions and division access.
Other platform objects	Objects that are not listed as covered continue to use existing access controls.
Recording bulk actions	ABAC does not enforce the recording bulk action API (bulk archive, export, or delete). Users can perform bulk actions only on recordings within their authorized access.
Orphaned recordings	Recordings without no valid parent conversation are not enforced by ABAC because there are no conversation attributes to evaluate.
Some speech and text analytics data	The transcription notifications API, topics and interaction categories detected, sentiment and empathy events and scores, test phrase, and topic miner snippets are not enforced by ABAC.
Quality management calibrations	Calibrations continue to use quality management permissions.
Survey scoring by customers	ABAC applies to internal user access to survey data, not to customers completing surveys.
Quality management audit query APIs	These APIs are not enforced by ABAC.
Aggregate queries and views	Analytics aggregate queries for evaluations and surveys, aggregate performance views, and survey aggregate reporting are not restricted by ABAC or search restriction.
Data privacy (GDPR) requests	Requests to delete conversations and recordings for privacy compliance are not constrained by ABAC policies. These requests do not give users visibility into restricted data.

Other reporting and analytics solutions that are not part of the Genesys Cloud platform might receive customer access attribute values but are responsible for their own filtering and enforcement.

Limitations

No field-level or partial-response filtering. ABAC allows or denies access to an entire resource. It does not redact fields, participant attributes, transcript segments, or other parts of a resource. Row-level suppression applies in search, where unauthorized rows are omitted entirely.
Search restriction does not evaluate policy expressions. It uses exact matching with ‘contains all’ logic. For more information, see Restricted search overview.
Artifacts are not classified separately. Access to artifacts is based on the customer access attributes of the parent conversation. You cannot assign a separate sensitivity to an individual recording or transcript.
Client credentials requests have no user attributes. OAuth clients that use the client credentials grant do not carry custom user attributes. Policies that reference user attributes evaluate those attributes as empty for these clients. You can exclude OAuth clients from a policy and govern them separately.
Existing roles are not redesigned. ABAC adds a layer on top of roles and divisions and does not change them. It also does not manage the lifecycle of attribute schemas.

Compatibility

If you do not create an ABAC policy for recordings, transcripts, evaluations, or surveys, there is no change in access behavior for your organization.
Conversations without customer access attributes keep their existing role and division behavior. Policies can explicitly allow or deny empty values.
If no customer access attributes are present in a search, existing permission and division rules continue to apply without additional restriction.
Future ABAC support for other areas of Genesys Cloud is introduced through explicit features that you configure. It does not automatically change existing behavior.

[NEXT] Was this article helpful?

Get user feedback about articles.