Attribute-based access control for recordings, transcripts, evaluations, and surveys

AI-generated summary

Genesys Cloud is a customer experience platform accessible through a comprehensive Resource Center that provides documentation, release notes, and announcements regarding platform updates, user interface changes, and feature deprecations. The platform offers products and solutions with tiered licensing options, detailed pricing information for additional features, and billing resources to support organizational needs. Key capabilities include Genesys Cloud AI, which enables real-time data collection and analysis to identify patterns and predict customer behavior, transforming AI innovation into the customer experience platform. The Resource Center provides setup guidance for initial Genesys Cloud CX organization configuration, user-type-specific resources tailored to different roles, instructional videos covering essential features and functionalities, and supplementary materials including FAQs, glossary definitions, education resources, services, support options, applications, security information, and legal documentation.

PrerequisitesClick to expand

Enable attribute-based access control (ABAC). For more information, see Enable attribute-based access control.
Make sure that the Customer Access Attribute is set on your conversations, including Bring Your Own Interactions (BYOI) conversations. You can update the attribute while the conversation is in progress or after it ends, and policies use the latest value.
Review how policies work. For more information, see Attribute-based access control overview and Create access policies.

Use attribute-based access control (ABAC) policies to control access to recordings, transcripts, AI summaries and insights, quality evaluations, and surveys associated with a conversation. Base these policies on the customer access attribute so that access can follow who the customer is and what the conversation is about, rather than only the divisions that the conversation touched.

Role-based access control (RBAC) with divisions grants a user access to a conversation if the user has a role bound to any division that an object in that conversation passed through, such as a queue, flow, or participant. For organizations with multiple lines of business or regions, this access can be broader than intended.

ABAC adds a layer of access control that Genesys Cloud evaluates before RBAC:

Genesys Cloud evaluates the applicable ABAC policy against the customer access attribute on the conversation.
If the policy denies access, the user cannot access the data, regardless of their roles.
If the policy authorizes access, Genesys Cloud applies the existing RBAC checks, including permissions, permission conditions, and divisions.

ABAC does not replace RBAC. A user must be authorized by both. ABAC policies also apply to the APIs that govern access to the supported recording, speech and text analytics, and quality management artifacts.

Note: If your organization has no ABAC policies for these targets, access control does not change. ABAC policies take effect only after you create them.

Policy targets

Each artifact type is a separate target, so you can apply different policies to each one. For example, you can base recording and transcript access on the customer’s profile and evaluation and survey access on the agent’s profile.

Targets use the domain:entity:action format.

RecordingClick to expand

Domain	Entity	Action	What it controls
Recording	Recording	View	Viewing recordings and recording metadata, including policy-based recordings and segments, snippet recordings, and screen recordings
Recording	Recording	Edit retention	Changing a recording’s retention, including the delete or archive date and restoring from archive
Recording	Annotation	View, manage	Viewing, adding, editing, and deleting recording annotations
Recording	Recording	Batch download	Creating recording batch download requests
Recording	Deletion Protection	Manage	Applying or revoking protection from deletion

Speech and text analyticsClick to expand

Domain	Entity	Action	What it controls
Speech and Text Analytics	Data	View	Transcripts
Speech and Text Analytics	AI Insights	View	AI summaries, insights, and reasons for sentiment

Quality managementClick to expand

Domain	Entity	Action	What it controls
Quality	Evaluation	Add, Delete, Edit, SearchAny, View	Creating, viewing, editing, and deleting evaluations
Quality	Survey	View	Viewing surveys

How access works

RecordingsClick to expand

If the ABAC policy authorizes access, users with the relevant Recording permissions, such as Recording > Recording > View, Recording > Recording Segment > View, Recording > Screen Recording > View, and Recording > Snippet Recording > View, can access the recordings of that conversation. This applies through the API and in Interaction Details, and to calls, messages, and emails.

If the policy denies access, the user cannot access any recordings of that conversation.

For batch downloads, Genesys Cloud evaluates ABAC for each recording in the request. Some recordings in the same batch can be returned while others are denied; the request is not all-or-nothing.

TranscriptsClick to expand

Voice

To view voice transcripts, a user needs Recording > Recording > View or Recording > Recording Segment > View, and Speech and Text Analytics > Data > View. Your organization also needs a license that includes Speech and Text Analytics.

Access authorized: The user can view all voice transcripts for the conversation in Interaction Details.
Access denied: The transcript panel displays Transcript is not available. The Copy Transcript and AI Translate buttons and sensitive data masking indicators are unavailable.

If a user has only partial access through division-based restrictions on Recording > Recording Segment > View, those restrictions continue to apply to transcripts.

Email and messaging

For email and messaging conversations, transcripts are governed by the Recording ABAC policy. This applies whether your organization uses Speech and Text Analytics or not.

Recording policy	Transcript (STA) policy	What the user sees in Interaction Details
Authorized	Authorized	The email or message content and the Speech and Text Analytics transcript data
Authorized	Denied	The email or message content only
Denied	Authorized	No content. A permission-denied message appears.
Denied	Denied	No content. A permission-denied message appears.

Important: When both policies are configured, the Recording policy takes precedence for digital conversations. A user who is denied by the Recording policy cannot see email or message content, even if the Speech and Text Analytics policy authorizes access.

AI summaries and insightsClick to expand

To view AI summaries and insights, a user needs Speech and Text Analytics > AiSummary > View and Speech and Text Analytics > sentimentData > View.

Access authorized: The user can view AI-generated summaries and insights, including reason for call, resolution, action items, and reason for sentiment. This includes interaction-level and agent-level summaries for voice and messaging conversations.
Access denied: The user cannot view AI summaries or insights. The sections do not appear or display an empty state.

Quality evaluationsClick to expand

Genesys Cloud uses two separate access-control mechanisms for quality evaluations. The mechanism that applies depends on whether a user accesses a specific evaluation or retrieves a list of evaluations.

Access to individual evaluations

ABAC access policies apply when an operation identifies a specific conversation or evaluation. Depending on the user’s existing permissions, these policies control the ability to:

Create an evaluation.
View an evaluation.
Edit or submit an evaluation.
Delete an evaluation.

If the ABAC policy authorizes access, users with the applicable Quality Evaluation permissions can manage evaluations for the conversation as permitted by their existing permissions, permission conditions, and divisions.

If the ABAC policy denies access, the user cannot access the evaluation data through the applicable UI or API, and Interaction Details does not display evaluations for that conversation.

Evaluation searches and lists

The default search restriction applies when an operation can return a list of evaluations. The restriction filters results to evaluations whose conversations are tagged with a subset of the requesting user’s values for the organization’s restriction source attribute, as well as evaluations for conversations that have no access attribute.

The default search restriction applies to:

Evaluation lists in Interaction Details.
Evaluation lists in the Agent Evaluations view.
Agreement scores for automated scoring questions in the Evaluation Form Editor.

The default search restriction operates independently from ABAC access policies.

Important: Configure both ABAC access policies and the default search restriction to restrict both direct access to individual evaluations and the evaluations that users can see in searches and lists. Configuring only one leaves the operations controlled by the other unrestricted. For example, if you configure an ABAC access policy but do not configure the default search restriction for evaluations, a user who is prevented from opening an evaluation directly may still see that evaluation in evaluation search and query results.

Note: Evaluation creation requires Genesys Cloud to retrieve the conversation’s Customer Access Attribute. If the attribute cannot be retrieved because the conversation is no longer available, creation is rejected for organizations that have previously used the Customer Access Attribute and allowed for organizations that have never used it.

Evaluation search and query results

ABAC policies control access to operations on individual quality evaluations associated with a conversation. Evaluation search and query results use a separate access-control mechanism based on the configured restriction source attribute.

To restrict both access to individual evaluations and the evaluations that users can see in search and query results, configure both ABAC policies and the restriction source attribute. If you configure ABAC policies without configuring the restriction source attribute for evaluations, a user who is denied access to an individual evaluation may still see that evaluation in search and query results.

SurveysClick to expand

If the ABAC policy authorizes access, users with Quality > Survey > View can view the surveys associated with the conversation. If the policy denies access, users cannot view survey data through the UI or API, and Interaction Details does not display surveys for that conversation.

Survey creation fails if Genesys Cloud encounters an error while retrieving the Customer Access Attribute for the conversation. If Genesys Cloud successfully determines that the conversation does not have a Customer Access Attribute, survey creation proceeds.

When access attribute filtering takes effect

When your organization configures its first conversation access attribute, access-attribute filtering for quality evaluations and surveys can take up to 30 minutes to apply across all servers. This is a one-time delay when your organization first adopts conversation access attributes and requires no action.

During this period, some users may still see evaluations or surveys that access-attribute filtering would otherwise hide, depending on which server handles the request. Role-based permissions and division access continue to apply normally.

After the initial period, access-attribute filtering applies to all of your organization’s evaluations and surveys, including existing ones. Subsequent changes to conversation access attributes are not subject to this initial delay.

Organizations that already use conversation access attributes and organizations that never configure them are unaffected.

What ABAC does not control

The following are not restricted by these ABAC policies, and their behavior does not change.

RecordingClick to expand

Speech and text analyticsClick to expand

Quality ManagementClick to expand

GeneralClick to expand

Existing conversations

Conversations created before you set up the Customer Access Attribute have an empty value. ABAC treats an empty value as null. To keep access to older conversations unchanged, write policies that authorize access when the attribute is null or empty.

Troubleshooting

When ABAC denies a request, the API returns a 403 error with an ABAC-specific message. This helps distinguish an ABAC denial from an RBAC permission denial.

[NEXT] Was this article helpful?

Get user feedback about articles.