ABAC policy targets for conversation resources

AI-generated summary

Genesys Cloud supports attribute-based access control (ABAC) policies to govern access to conversation resources including recordings, transcripts, AI-generated insights, evaluations, and surveys through a hierarchical permission structure. Recording access is controlled through specific permissions for standard recordings, recording segments, snippet recordings, and screen recordings, with additional controls for viewing and managing annotations, batch downloads, deletion protection, and retention settings such as delete or archive dates. Transcript availability requires combined permissions for both recording access and Speech and Text Analytics data viewing. AI-generated insights including summaries, sentiment analysis, reasons for calls, resolutions, and action items are controlled through separate Speech and Text Analytics permissions. Quality management policies govern evaluation and survey access, controlling functions such as creating, viewing, editing, submitting, assigning, and deleting evaluations, as well as viewing surveys. ABAC policies are evaluated first for each resource using policy targets in the format domain:entity:action. If access is allowed through ABAC, user role permissions and division grants are then applied as secondary controls. Both the ABAC policy and role permissions must authorize access for a user to access a resource. ABAC policies apply independently to each artifact type; granting access to one resource type does not automatically grant access to others. Access decisions are made at the time of resource access for active, historical, and archived conversations. If no policy is created for a resource type, access continues to follow existing roles and divisions. ABAC allows or denies entire resources rather than individual fields or sections. API endpoints are enforced consistently with user interface restrictions. Prerequisites for implementation include specific authorization, recording, analytics, and quality management permissions, as well as assignment of customer access attributes to conversations and custom user attributes to users. Search results are filtered by the organization's Restriction Source Attribute, and unauthorized users see restricted functionality such as unavailable transcript copying, translation, and named entity recognition features.

PrerequisitesClick to expand

The following permissions:

Authorization > Policy – Add
Authorization > Policy – Edit
Authorization > Policy – Delete
Authorization > Policy – View
Recording > Recording – View
Recording > Recording Segment – View
Recording > Snippet Recording – View
Recording > Screen Recording – View
Speech and Text Analytics > Data – View
Speech and Text Analytics > AiSummary – View
Speech and Text Analytics > sentimentData – View
Quality > Evaluation
Quality > Survey

Create attribute-based access control (ABAC)policies for the recordings, transcripts, evaluations, and surveys that are associated with conversations. This article lists the available policy targets and describes how each is enforced.

Before you begin

Assign customer access attributes to conversations and custom user attributes to users. For more information, see Customer access attributes and custom user attributes overview.

Policy targets

A policy target identifies the resource and action that the policy governs, using the format domain:entity:action. You can create policies for the following targets.

RecordingsClick to expand

Target	Governs
Recording:Recording:View	Viewing and retrieving recordings and recording metadata. For ABAC purposes, includes policy-based recordings, recording segments, snippet recordings, and screen recordings.
Recording:Recording:EditRetention	Changing recording retention, such as setting the delete date or archive date or restoring from archive.
Recording:Annotation:View	Viewing recording annotations.
Recording:Annotation:Manage	Creating, updating, and deleting recording annotations.
Recording:Recording:BatchDownload	Creating and monitoring batch recording download requests.
Recording:DeletionProtection:Manage	Applying or revoking deletion protection.

Speech and Text AnalyticsClick to expand

Target	Governs
Speech and Text Analytics:Data:View	Viewing transcripts.
Speech and Text Analytics:AI Insights:View	Viewing AI summaries and sentiment reasons, including reason for call, resolution, action items, and reason for sentiment.

Quality managementClick to expand

Target	Governs
Quality:Evaluation:Add, Delete, Edit, SearchAny, View	Evaluations. Managing evaluations includes creating, viewing, editing, submitting, assigning, declining on dispute, releasing, and deleting.
Quality:Survey:View	Viewing surveys.

The public API endpoints associated with each target are enforced consistently, so the restrictions that you see in the Genesys Cloud user interface matches the restrictions for programmatic access. Endpoints in the Genesys Cloud API Explorer indicate the target that they are evaluated against.

How is ABAC combined with role permissions?

For each resource, Genesys Cloud evaluates the ABAC policy first. If the policy allows access, the user’s role permissions and division grants are then applied. Both must allow access.

For example, if your organization has a policy on recordings and a supervisor has the Recording > Recording – View permission:

If the policy allows access, the supervisor can view all recordings of the conversation, subject to the supervisor’s role permissions and divisions.
If the policy denies access, the supervisor cannot view any recordings of that conversation.

The same pattern applies to the other targets. A user with the corresponding permission can use the resource only if the ABAC policy also authorizes access.

Behavior by resource

RecordingsClick to expand

TranscriptsClick to expand

Policies apply when a user has Recording > Recording – View or Recording > Recording Segment – View and Speech and Text Analytics > Data – View. If the user is not authorized, the entire Transcript page appears empty with the message “Transcript is not available,” and the Copy Transcript, Translate, and NER features are unavailable.

If a user has access to only some transcripts because of division-based access on Recording > Recording Segment – View, that behavior continues to apply.

AI summaries and insightsClick to expand

Evaluations and surveysClick to expand

Considerations

Each artifact type is evaluated independently. Allowing access to one artifact type does not allow access to another, and a denial on the conversation does not by itself deny access to its artifacts. Create policies for each resource type you want to protect.
If you do not create a policy for a resource type, nothing changes. Access continues to follow roles and divisions.
Decisions are made at the time of access. The same policy applies to active, historical, and archived conversations.
ABAC allows or denies the whole resource. It does not remove individual fields or sections.

[NEXT] Was this article helpful?

Get user feedback about articles.