Agent Desk Permissions - Resource, Scope & Groups Mapping
Introduction:
This document provides a comprehensive explanation of the permissions assigned to agents within AgentDesk. It covers the intricacies of resource and scope mapping, along with detailed descriptions of connected permission groups and roles with each scope. If you need to make changes to AgentDesk permissions using Keycloak, this guide will help you understand the existing permission structure, enabling you to add new scopes to the underlying permissions and integrate them with existing or new permission groups and roles in Keycloak.
This document is an essential resource for developers looking to effectively manage and extend the permission framework within AgentDesk.
All Resources are defined in Keycloak in spinal-case
All Scopes and Groups are defined in Keycloak in snake_case
Till 4.5: Supervisor and Senior Agent must be assigned both agents_permission and senior_agents_permission_permission groups.
4.5.1 Onwards: Supervisor and Senior Agent must be assigned senior_agents_permission_permission group. senior_agents_permission_permission became superset of agents_permission group (If we assign senior_agents_permission_permission then all the permissions of agents_permission will be automatically assigned to agent/supervisor).
Role | Permission Groups | |
|---|---|---|
1 | admin | In Order for admin to perform operations in AgentDesk. He should be provided following Role and Permission Group:
|
2 | supervisor | senior_agents_permission_permission |
3 | agent | Senior Agents: senior_agents_permission_permission |
Permission | Description | Resource | Scopes | Groups | |
|---|---|---|---|---|---|
1 | Customer PII | For security reasons, the PII customer data should be protected from unauthorized access. |
| view_pii: With this scope, users can see all PII attributes of a customer (without masking). masked_pii: With this scope, users can only see customer attributes as masked. Note: In future, anyone with manage scope for Edit Customer Profiles can view all attributes unmasked (even when masked_pii scope assigned to it. manage scope bypasses masked_pii scope) | senior_agents_permission_permission: view_pii scope is linked to it.
|
2 | Access Customer Profiles | Agents are able to view customer profiles with this permission, without an active conservation view with a customer |
| view: Agent with this scope can view the customer profile without any active session with a customer. | All agents, senior agents, supervisors are able to access the customer list. |
3 | Edit Customer Profile |
|
| manage: users with this scope can edit the customer profile without any active session with a customer. manage_in_conversation: users with this scope can edit the customer profile ( link profiles) only when the conversation view is visible. | agents_permission: All agents have the manage_in_conversation scope assigned. senior_agents_permission_permission: have the manage scope assigned. |
4 | Create New Customer | Users with this permission can able to create new customer |
| manage |
|
5 | Manage Customer Schema | Users can manage (create/update/delete) customer schema |
| manage |
|
6 | View Customer Schema | Users with this permission can view customer schema |
| view |
|
7 | Assign Labels | Users can assign labels to customers with this permission. |
| assign_label: Users with this scope can Create/View and Assign labels to customer. |
Disclaimer:
|
8 | Manage Labels | Users can manage (edit, delete) labels with this permission. |
| manage |
|
9 | View Customer History | With this permission, an agent can view activities of older conversations with this customer. An additional requirement: Different access levels to view customer history for an agent:
|
| view_history_active_customer : Users with this scope have complete access to Conversation History only during an active conversation with the customer view_history : Users with this scope have complete access to Conversation History regardless of any active conversation with a customer in conversation view. |
agents_permission: |
10 | Do Direct Transfer | An agent can transfer a chat to other agents/supervisors using this permission so that only the users having these permission should be able to transfer a conversation to supervisors or other agents. |
| view_direct_transfer: Agent with this scope has permission to transfer chat directly (without consult) to other agents/suprevisors to save customer time. (covers both use-cases for queue-transfer and agent-transfer) | agents_permission: |
11 | Do Consult | An agent can consult other agents/supervisors using this permission so that only the users having this permission should be able to consult with other supervisors and agents. |
| view_consult: An agent with this scope has permission to consult other agents/supervisors. (covers both use cases for queue-transfer and agent transfer) | agents_permission: |
12 | Do Conference | An agent can add other agents/supervisors as a primary participant to active conversation. (Currently an agent can add only single agent/supervisor as a primary participant). |
| view_conference: Agent with this scope has permission to add other agent/supervisor as primary participant in active conversation with customer. | agents_permission: |
13 | Start a new session / agent initiated messaging | All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer. |
| view_initiate_chat: Agent with this scope has the permission to start a new conversation or a new channel session within a conversation, on available media channels. | All agents, senior agents, supervisors should be able to start a new channel session or a new conversation with a customer. |
14 | Add Wrap-up/ Notes | Agent can able to add wrap-up notes with this permission. |
| view_wrap_up: Agent with this scope has permission to add wrap-up notes. | agents_permission: |
15 | Leave Chat | Agent/Supervisor will be able to leave chat |
| view_leave_chat: Agent with this scope has permission to leave chat. | agents_permission: |
16 | State Change | User will be able to change and view agent and MRD states |
| manage_state_change | agents_permission: |
17 | Subscribed List | Agent/Supervisor will be able to mange subscribed list |
| view: Agent with this scope has permission see and join available chat. manage: Supervisor with this scope has permission see, join, end chat. | agents_permission:
|
19 | Recording Link |
|
| view: Agent/Supervisor with this scope has permission to only see his own recording links in a conversation. | agents_permissions: To allow any user to be able to only access their respective recording links in a conversation. senior_agents_permissions: To allow any user to be able to access all the recording links in a conversation. |
20 | Agent Dashboard | Agent can view all his stats and queue status on Dashboard on home screen |
| view: Agent with this scope has permission to see the Dashboard containing all his stats about Team/Queue | agents_permission: |