Access control overview

AI-generated summary

Genesys Cloud's access control allows administrators to create divisions to categorize resources like queues, campaigns, and flows. Users can be granted selective permission to view, add, edit, and delete resources in specified divisions. Transactional data like conversations and recordings also encounter divisions as they move through Genesys Cloud. Assigning users to divisions does not automatically grant access; permissions must be explicitly defined. For example, supervisors can be restricted to agents and queues in their division, while agents can transfer interactions to any queue or user regardless of division. To configure division access, administrators identify roles with appropriate permissions, assign users to those roles, and assign divisions to the roles and users. An example outlines an organization with Raleigh, San Francisco, and Corporate divisions containing specific resources. User role division access is then configured by creating a Supervisor role with permissions, assigning it to Diane, Jesse and Sam, and granting each access to certain divisions they manage. This allows Diane as East Supervisor to access Raleigh queues and campaigns, while Jesse as West Supervisor accesses San Francisco call flows and queues. Sam as Supervisor for both East and West divisions can access resources in both. Genesys Cloud's division access by user role allows granular control over which users can view and manage resources in their assigned divisions.

Access control gives administrators the ability to create separate units, or , in which to divide and categorize resources, or objects. Administrators can then selectively grant users access to the set of objects. This access includes permission to view, add, edit, and delete objects. Access control also tags data that Genesys Cloud considers a transaction to the divisions it encounters as it travels through the system.

Note: You can , regardless of division restrictions.

Create divisions to separate business units within the organization

Organizational separation is helpful for organizations that have multiple business units, or business units in different physical location. Divisions ensure that these business units generally operate independently from other areas, but continue to reside under the primary organization. You can move certain objects into a division and then specify which users can view or manage the objects in that division. Managers, administrators, and other defined roles can only access objects in the divisions to which they are granted permission.

It is important to consider that divisions do not provide complete separation. For example, some objects are not eligible for inclusion in a division, and divisions share some resources such as Edges. If you need a separate business unit for regulatory requirements or sensitive data purposes, best practice recommends that you create separate organizations in Genesys Cloud.

For more information about divisions, see Divisions overview and Create a division.

Determine which users have access to resources and data

Access control considers certain organizational resources and data as objects in Genesys Cloud. The types of objects that apply to access control are and .

Configuration objects

Configuration objects are specific resources within the organization. These resources include:

Call routing objects
Coaching appointments
Contact lists
Data tables
Do not contact lists
Emergencies
Extensions
Flows
Flow milestones
Flow outcomes
Learning modules
Management units
Message routing objects
Outbound campaigns
Queues
Schedules
Schedule groups
Scripts
Users

Administrators can separately assign individual objects to a division and then selectively grant user access to the objects in that division. A configuration object can only belong to one division. This access includes view, add, edit, and delete. For more information, see Access control configuration objects.

Transactional objects

are objects that interact with or travel through the system.

Transactional objects include:

Voice, callback, chat, email, and message conversations
Recordings
Presence history
Audit data

While these objects are not the only transactional objects that exist in Genesys Cloud, they are the only ones protected by access control. A transactional object can encounter more than one division. For more information, see Access control transactional objects.

Distinguish users as objects vs. users with access

A user can be a configuration object within a division. However, an administrator can also grant a user permission to access a division. It is important to note that moving a user into a division does not give that user access to the data within the division. The user’s data, such as profile information, is part of the division, and users who have the appropriate division permission assigned can access that data.

For example, an administrator moves Danny Cho into the Raleigh division, but Danny Cho does not have permission to manage objects in the Raleigh division. He cannot access any configuration object within the Raleigh division; he cannot edit a queue, add a campaign, or delete a call flow.

However, any user with the add, edit, view, or delete permissions to access users in the Raleigh division can modify Danny Cho’s user data.

Provide access to divisions

You can grant an individual user access to a division, and you can grant access to all users configured within groups. A benefit of access control is the ability to grant appropriate users access to only the objects they intend to manage. For example, you can use access control to allow Supervisors to work only with the agents and queues that they manage. Flow authors can only add, edit, or delete the flows for which they are responsible.

By design, the Agent role has fewer restrictions with access control. For example, an agent can transfer to any queue or user in the system, regardless of the queue’s or user’s division. This behavior ensures that agents can successfully process interactions. Agent A in Division ABC can transfer a call to Agent X in Division XYZ without being granted permission to access Division XYZ.

To provide a user access to a division, an administrator must:

Identify an existing role with the appropriate permissions; for example, a default role, or optionally create the role with the appropriate permissions. The administrator can grant this role to multiple users. For more information, see Add roles.
Assign the role with the appropriate permissions to a user, unless the user already has the role. For more information, see Grant a role and a division to a user. This task assigns the role with the appropriate permission and the division to a user.
Assign the division to the role, if you did not do so in Step 2. To perform this task, do any of the following:
- Add the division to selected individuals assigned to the role. For more information, see Assign roles in Assign roles, divisions, licenses, and add-ons.
- Assign the division to groups.

For more information about providing a user access to divisions and granting the ability to move objects, see Access control quick start guide.

Example: Organization with multiple divisionsClick to expand

In this example, the organization creates three divisions:

Raleigh, NC: An admin places the Support East, Marketing East, and Sales East queues into this division.
San Francisco, CA: An admin places the West queues into this division.
Corporate: This division includes objects that perhaps don’t fit easily into other divisions. In this case, the main menu flow into which all customers enter. This flow is not specific to east or west. Depending on information they provide, the system transfers them to the proper division. Examples in the graphic: customer care, priority support.

Division	Objects
Raleigh	Queues: Support East, Marketing East, Sales East Workforce management unit: East Unit Outbound campaign: Local area promotion
San Francisco	Call flow: West coast menu Queues: Support West, Marketing West, Sales West Workforce management unit: West unit
Corporate	Call flows: Main menu Queues: Customer Care, Priority Support Outbound campaign: Customer Satisfaction Survey

Example: Configure accessClick to expand

Now that the administrator created divisions and assigned object to each division, the next steps are: Create a role, assign the role to the appropriate users, and then assign to those users the divisions for which they are responsible. In this example, the administrator:

Creates a Supervisor role.
Grants the Supervisor role the permissions required to create and manage call flows, management units, queues, and outbound campaigns.
Assigns the Supervisor role to Diane, Jesse, and Sam.
Gives Diane’s Supervisor role access to the Raleigh division. Diane can only work with the objects in the Raleigh division.
Gives Jesse’s Supervisor role access to the San Francisco division. Jesse can only work with the objects in the San Francisco division.
Gives Sam’s Supervisor role access to the Corporate, Raleigh, and San Francisco division. Sam can work with objects in all three divisions.

User	Role	Division	Access
Diane	Supervisor	Raleigh	Queues: Support East Marketing East Sales East Outbound campaign: Local area promotion Workforce management unit: East Unit
Jesse	Supervisor	San Francisco	Call flow: West coast menu Queues: Support West Marketing West Sales West Workforce management unit: West unit
Sam	Supervisor	Raleigh San Francisco Corporate	Call flows: Main menu West coast menu Queues: Customer Care Priority Support Support East Marketing East Sales East Support West Marketing West Sales West Outbound campaign: Customer Satisfaction Survey Local area promotion Workforce management unit: East unit West unit

Multiple users can have the same role; however, when you assign divisions to each user’s role, the user can only access objects in that division. All three users in our example have the same role, but not all users have the same divisions assigned to that role. Therefore, each user has the same permissions, but to different sets of objects per the division associated to their role.

[NEXT] Was this article helpful?

Get user feedback about articles.