Agent Desk Permissions - Resource, Scope & Groups Mapping
Introduction:
Developer Guide to AgentDesk Permissions in Keycloak. This document provides a comprehensive explanation of the permissions assigned to agents within AgentDesk. It covers the intricacies of resource and scope mapping, along with detailed descriptions of connected permission groups and roles with each scope. If you need to make changes to AgentDesk permissions using Keycloak, this guide will help you understand the existing permission structure, enabling you to add new scopes to the underlying permissions and integrate them with existing or new permission groups and roles in Keycloak. This document is an essential resource for developers looking to effectively manage and extend the permission framework within AgentDesk.
All Resources are defined in Keycloak in spinal-case
All Scopes and Groups are defined in Keycloak in snake_case
Note that the following table and group segregation are for agents only and not for Supervisors. Supervisor permissions structure should remain intact as working in the previous versions.
Supervisor and Senior Agent must be assigned both agents_permission and senior_agents_permission groups.
From release 4.5.1: senior_agents_permission group is a superset of agents_permission group (If we assign senior_agents_permission then all the permissions of agents_permission will be automatically assigned to agent)
Permission | Description | Resource | Scopes | Groups | |
|---|---|---|---|---|---|
1 | Customer PII | For security reasons, the PII customer data should be protected from unauthorized access. |
|
masked_pii: With this scope agent can only see customer attributes as masked. Note: Anyone with manage scope for Edit Customer Profiles can view all attributes unmasked. (Even when masked_pii scope assigned to it. manage scope bypasses this permission) |
|
2 | Access Customer Profiles | Agents are able to view customer profiles with this permission, without an active conservation view with a customer |
| view: Agent with this scope can view the customer profile without any active session with a customer. | All agents, senior agents, supervisors are able to access the customer list. |
3 | Edit Customer Profile |
|
| manage: Agent with this scope can edit the customer profile without any active session with a customer. manage_in_conversation: Agent with this scope can edit the customer profile ( link profiles) only when the conversation view is visible. | agents: All agents have the manage_in_conversation scope assigned. senior_agents: have the manage scope assigned. |
4 | Create New Customer | Admin/Supervisor can able to create new customer |
| manage: Agent with this scope can create new customer. |
|
5 | Manage Customer Schema | Admin/Supervisor can manage (create/update/delete) customer schema |
| manage: Users with this permission can Create/Edit/Delete Customer Schema. |
(role based) |
6 | View Customer Schema | Only specialized agents can view customer schema |
| view: Agents/Supervisors with this scope has permission to view customer schema list. |
|
7 | Assign Labels | Agent can assign labels with this permission. |
| assign_label: Agent with this scope can Create/View and Assign labels to customer. |
|
8 | Manage Labels | Supervisor can manage labels with this permission. |
| manage: Supervisors with this permission can Edit/Delete labels. |
(role based) |
9 | View Customer History | With this permission, an agent can view activities of older conversations with this customer. An additional requirement: Different access levels to view customer history for an agent:
|
| view_history_active_customer : Agent with this scope have complete access to Conversation History only if agent interacted with customer in conversation view. view_history : Agent with this scope have complete access to Conversation History regardless of any active conversation with a customer in conversation view. view_history_interacted_customer : (Reserved for future) |
agents: |
10 | Do Direct Transfer | An agent can transfer a chat to other agents/supervisors using this permission so that only the users having these permission should be able to transfer a conversation to supervisors or other agents. |
| view_direct_transfer: Agent with this scope has permission to transfer chat directly (without consult) to other agents/suprevisors to save customer time. (covers both use-cases for queue-transfer and agent-transfer) | agents: |
11 | Do Consult | An agent can consult other agents/supervisors using this permission so that only the users having this permission should be able to consult with other supervisors and agents. |
| view_consult: An agent with this scope has permission to consult other agents/supervisors. (covers both use cases for queue-transfer and agent transfer) | agents: |
12 | Do Conference | An agent can add other agents/supervisors as a primary participant to active conversation. (Currently an agent can add only single agent/supervisor as a primary participant). |
| view_conference: Agent with this scope has permission to add other agent/supervisor as primary participant in active conversation with customer. | agents: |
13 | Start a new session / agent initiated messaging | All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer. |
| view_initiate_chat: Agent with this scope has the permission to start a new conversation or a new channel session within a conversation, on available media channels. | All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer. |
14 | Add Wrap-up/ Notes | Agent can able to add wrap-up notes with this permission. |
| view_wrap_up: Agent with this scope has permission to add wrap-up notes. | agents: |
15 | Leave Chat | Agent/Supervisor will be able to leave chat |
| view_leave_chat: Agent with this scope has permission to leave chat. | agents: |
16 | State Change | User will be able to change and view agent and MRD states |
| manage_state_change | agents: |
17 | Subscribed List | Agent/Supervisor will be able to mange subscribed list |
| view: Agent with this scope has permission see and join available chat. manage: Supervisor with this scope has permission see, join, end chat. | agents: supervisor: manage scope is linked to this role. (Role based) |
18 | Supervisor Dashboard | Supervisor can view all dashboards (for now) |
| view_all: | |
19 | Recording Link |
|
| view: Agent/Supervisor with this scope has permission to only see his own recording links in a conversation. | agent_permissions: To allow any user to be able to only access their respective recording links in a conversation. senior_agent_permissions: To allow any user to be able to access all the recording links in a conversation. |
20 | Agent Dashboard | Agent can view all his stats and queue status on Dashboard on home screen |
| view: Agent with this scope has permission to see the Dashboard containing all his stats about Team/Queue | agents: |