Attribute-based access control overview

AI-generated summary

Genesys Cloud combines Attribute-Based Access Control (ABAC) with Role-Based Access Control (RBAC) and divisions to provide granular access management through Boolean logic evaluation of user, resource, and environmental attributes. The system operates on a default-deny principle where DENY policies override ALLOW policies, and access is granted only when users satisfy ALLOW policy conditions, possess necessary permissions, and do not match any DENY policies. ABAC policies target specific API calls using domain:entity:action syntax and apply to defined user subsets through four core components: Target (the resource and action being performed), Subject (the user, group, or OAuth client to which the policy applies), Effect (ALLOW or DENY determination), and optional Conditions (specific criteria using JSON-formatted attribute comparisons). Authorization requires both ABAC policy evaluation and traditional permission verification using JSON-based conditional logic with Any/OR and All/AND operators. Policies are evaluated sequentially, with DENY policies immediately blocking access regardless of matching ALLOW policies, and access denied by default if a resource has attached policies but the user matches no conditions. Preset Attributes enable static value comparisons through TypedAttribute objects with strict naming conventions supporting only alphanumeric characters, periods, and underscores. Each preset attribute entry contains a key representing the attribute name and a value consisting of a TypedAttribute object with type (specifying the basic data type) and value (providing a string representation) members. Validation prevents conflicts with existing system attributes. Genesys Cloud provides four pre-built policy templates for common use cases: gamification scorecard access control limiting supervisor visibility to agents within three reporting hierarchy levels, IP address-based access restrictions, time-frame-based access control, and role assignment prevention for non-admin users. Only one policy per target-subject combination is permitted; additional conditions must be added to existing policies rather than creating duplicates. ABAC operates alongside existing role-based access controls rather than replacing them, requiring final permission verification before resource access is granted.

Attribute-based access control (ABAC) is an authorization model that evaluates attributes to determine access. Attributes can relate to the subject (the user or entity requesting access), the object (the resource or file the subject wants to access), or even the environment (other parameters such as time of the day, IP address, and so on).

ABAC policies work alongside RBAC (role-based access control) and divisions to provide more access control granularity. These policies are Boolean logic statements where a condition is evaluated to a true or false result. Each policy targets a specific group of API calls (known as a target) and applies to a specific subset of users (known as the subjects).

To start using ABAC, enable attribute-based access control first.

Currently, Genesys Cloud provides with you the following templates designed for specific use cases to help you create ABAC policies. You can either use these templates or create your own policy by using a combination of the attributes and targets available for ABAC policies.

Note: You can have only one policy with the same target and subject combination. If you need to create more conditions for the same target-subject combination, add them to the existing policy.

Access Control for Gamification Scorecard and Insights – The policy created using this template allows supervisors to view gamification data only for agents who are within three levels of their reporting hierarchy, while admins with designated roles have full access to gamification data for all agents.
Allow Access from Certain IP Addresses – The policy created using this template allows or denies users access to Genesys Cloud based on their connecting IP address or the IP address range.
Allow Only During a Time Frame – The policy created using this template allows or denies users access to Genesys Cloud based on a specific time range on specific days.
Cannot grant new roles – The policy created using this template prevents non-admin users from granting roles that they do not themselves have.
Cannot update certain user profile fields – The policy created using this template prevents defined user profile fields from being modified except by supervisors or admins.

Definitions used in ABAC

Term	Description
Policy Name	The name of the policy set by the policy creator on policy creation or update.
Description	(Optional) A short description of the policy set by the policy creator.
Target	The targeted resource to which the policy applies. Resource targets take the form of `domain:entity:action` and reflect the action that the subject is attempting to perform (`directory:userprofile:edit`). The target reflects what the user is trying to do and typically equates to an API call to edit, view, or delete a resource. Policies are associated with targets.
Subject	The subject of a policy is the user, group, or client to which the policy applies. Policies can have only one subject. The subject has the following members: type: Indicates if a policy applies to a single user, a group of users, a specific OAuth client, or all users/clients accessing the resource. The type attribute must be one of the following: user, group, client, or all. id: The GUID of the user/group/client, when the subject type is all this value is ignored.
Effect	The effect of a policy indicates whether the policy allows access when its conditions are met, or immediately deny access when conditions are met. If a user meets the conditions of an ALLOW policy, has the requisite permissions, and is not blocked by a DENY policy, they are allowed access to the resource. ABAC does not replace the existing role-based access and divisional access controls. It works right alongside them to provide more fine-grained access control. If the result of an ABAC policy evaluation is ALLOW, the system then checks to see if the subject has the necessary permission before allowing access. Policies with an effect of DENY specify conditions under which access to the resource must be denied. If a user matches the conditions of a DENY policy, they are denied access regardless of whether they also match the conditions of an ALLOW policy on the same resource. If a resource has at least one policy attached but the user does not match the conditions for any of the policies, the user is denied access to the resource by default.
Condition	(Optional) Establishes specific conditions under which the policy allows or denies access. The following basic pattern (in JSON) represents each evaluated condition: `"attribute.one": { "comparison_operation": "attribute.two" }` When the policy is evaluated, the system retrieves the attributes corresponding to the supplied attribute names and compares them using the supplied operation. Multiple conditions can be nested inside an Any (representing logical OR) or All (representing logical AND) structure, to allow for more complex condition logic.
Preset Attributes	(Optional) A map of static, pre-defined attributes that are compared against attribute data from the system. For example, the policy creator wants to allow access to any user with a specific role ID, and they supply the role ID in question as a preset attribute in the policy. The policy creator sets the preset attribute names. Names that conflict with existing attributes supplied by the system is rejected on validation. Preset attribute names can contain alphanumeric characters, periods (.), and underscores ( _ ) but not spaces or special characters other than the ones listed. Each map entry has a key, which is the name of the preset attribute, and a value, which is a TypedAttribute object, with the following members: type: The basic data type of the attribute. value: A string representation of the value of the attribute.

For more information, see Create Access Policies, Attribute-based access control for recordings, transcripts, evaluations, and surveys, and Attribute-based access control.

[NEXT] Was this article helpful?

Get user feedback about articles.

Loading...

Attribute-based access control overview

Definitions used in ABAC

[NEXT] Was this article helpful?