Agent Desk Permissions - Resource, Scope & Groups Mapping

This document is an essential resource for developers looking to effectively manage and extend the permission framework within AgentDesk.

All Resources are defined in Keycloak in spinal-case

All Scopes and Groups are defined in Keycloak in snake_case

Till 4.5: Supervisor and Senior Agent must be assigned both agents_permission and senior_agents_permission_permission groups.
4.5.1 Onwards: Supervisor and Senior Agent must be assigned senior_agents_permission_permission group. senior_agents_permission_permission became superset of agents_permission group (If we assign senior_agents_permission_permission then all the permissions of agents_permission will be automatically assigned to agent/supervisor).

In order to understand the roles and their permission groups, please see Agent Authorization with Agent Desk.

	Permission	Description	Resource	Scopes	Groups
1	Customer PII	For security reasons, the PII customer data should be protected from unauthorized access.	`customer`	manage: With this scope, users can see and edit all PII data in the PII attributes with or without an active conversation. masked_pii: With this scope, users can see the PII data as masked. manage_in_conversation: users with this scope can edit the customer profile ( link profiles) only when the conversation is active. With this scope, they can also see the PII data as unmasked.	`senior_agents_permission`: manage scope is assigned to this group. `agents_permission:` masked_pii and manage_in_conversation scopes are linked to it. This means that all agents can see the PII data as unmasked and edit the relevant attributes if needed during an active conversation. Disclaimer: If you want to restrict the users from seeing the PII attributes of a customer during an active conversation, go to, Clients → cim → Authorisation → Policies, search for Edit Customer Profile - manage_in_conversation - Policy and remove agents_permission group.
2	Access Customer Profiles	Agents are able to view customer profiles with this permission, without an active conservation view with a customer	`customer`	view: Agents with this scope can view the customer profile without any active session with a customer.	All agents, senior agents, supervisors are able to access the customer list.
3	Edit Customer Profile	Users with this permission can edit customer profiles	`customer`	manage: Users with this scope can edit the customer profile without any active session with a customer. manage_in_conversation: users with this scope can edit the customer profile ( link profiles) only when the conversation view is visible.	`agents_permission:` manage_in_conversation scope is linked to it. `senior_agents_permission:` the manage scope is assigned to it.
4	Create New Customer	Users with this permission can be able to create new customer	`customer`	manage	`senior_agents_permission: manage` scope is linked to it.
5	Manage Customer Schema	Users can manage (create/update/delete) customer schema	`customer-schema`	manage	`senior_agents_permission: manage` scope is linked to it. ~~(role based)~~
6	View Customer Schema	Users with this permission can view customer schema	`customer-schema`	view	`senior_agents_permission: view` scope is linked to it.
7	Assign Labels	Users can assign labels to customers with this permission.	`customer-labels`	assign_label: Users with this scope can Create/View and Assign labels to customers.	`agents_permission: assign_label` scope is linked to it. Disclaimer: Agents can do it in active conversation Senior Agents can do it with or without any active conversation
8	Manage Labels	Users can manage (edit, delete) labels with this permission.	`customer-labels`	manage	`supervisor: manage` scope is linked to it. ~~(role based)~~
9	View Customer History	With this permission, users can view activities of older conversations with this customer. With this permission, there are two different access levels to view customer history for an agent: Complete access to Conversation History only when a conversation with this customer is active Complete access to Conversation History regardless of any active conversation with a customer	`agent-conversation-control`	view_history_active_customer : Users with this scope have complete access to Conversation History only during an active conversation with the customer view_history : Users with this scope have complete access to Conversation History regardless of any active conversation with a customer in conversation view.	`senior_agents_permission:` view_history scope is linked to this group. Only senior agents can view history of any customer with or without any active conversation. agents_permission: `view_history_active_customer` is linked to this group. Agents with this scope can only see the past conversations of customer once an active conversation with the same customer is going on.
10	Do Direct Transfer	Users can transfer a chat to other agents/supervisors using this permission so that only the users having these permission should be able to transfer a conversation to supervisors or other agents.	`agent-conversation-control`	view_direct_transfer: Agent with this scope has permission to transfer chat directly (without consult) to other agents/suprevisors to save customer time. (covers both use-cases for queue-transfer and agent-transfer)	agents_permission: `view_direct_transfer` scope is linked to this group.
11	Do Consult	An agent can consult other agents/supervisors using this permission so that only the users having this permission should be able to consult with other supervisors and agents.	`agent-conversation-control`	view_consult: An agent with this scope has permission to consult other agents/supervisors. (covers both use cases for queue-transfer and agent transfer)	agents_permission: `view_consult` scope is linked to this group.
12	Do Conference	An agent can add other agents/supervisors as a primary participant to active conversation. (Currently an agent can add only single agent/supervisor as a primary participant).	`agent-conversation-control`	view_conference: Agent with this scope has permission to add other agent/supervisor as primary participant in active conversation with customer.	agents_permission: `view_conference` scope is linked to this group.
13	Start a new session / agent initiated messaging	All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer.	`agent-conversation-control`	view_initiate_chat: Agent with this scope has the permission to start a new conversation or a new channel session within a conversation, on available media channels.	All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer.
14	Add Wrap-up/ Notes	Agent can able to add wrap-up notes with this permission.	`agent-conversation-control`	view_wrap_up: Agent with this scope has permission to add wrap-up notes.	agents_permission: `view_wrap_up` scope is linked to this group.
15	Leave Chat	Agent/Supervisor will be able to leave chat	`agent-conversation-control`	view_leave_chat: Agent with this scope has permission to leave chat.	agents_permission: `view_leave_chat` scope is linked to this group.
16	State Change	User will be able to change and view agent and MRD states	`state-change`	manage_state_change	agents_permission: `manage_state_change` scope is linked to this group.
17	Subscribed List	Agent/Supervisor will be able to mange subscribed list	`subscribed-list`	view: Agent with this scope has permission see and join available chat. manage: Supervisor with this scope has permission see, join, end chat.	agents_permission: `view` scope is linked to this group. ~~supervisor: manage~~ ~~scope is linked to this role.~~ ~~(Role based)~~
19	Recording Link	Users can only see their own recording link in a Conversation. Agents/Supervisors can see all the recording links in a Conversation.	`recording-link`	view: Agent/Supervisor with this scope has permission to only see his own recording links in a conversation. view_all: Agent/Supervisor with this scope has permission to see all the recording links in a conversation.	agents_permissions: To allow any user to be able to only access their respective recording links in a conversation. senior_agents_permissions: To allow any user to be able to access all the recording links in a conversation.
20	Agent Dashboard	Agent can view all his stats and queue status on Dashboard on home screen	`agent-dashboard`	view: Agent with this scope has permission to see the Dashboard containing all his stats about Team/Queue	agents_permission: `view` scope is linked to this group.