Permissions (RBAC)
Bot Analytics Permissions
Bot Analytics permissions let Analytics Admins control two things for every dashboard user: what they can do in Bot Analytics (view custom dashboards, export data, open employee-level drill-downs) and which employees' data they can see (all employees, or only a subset such as one region or business unit).
You manage permissions through groups. You define the feature access and data access once on a group, then assign users to it. Restrictions are enforced on the server for every Bot Analytics query, so they apply to dashboards, drill-downs and exports alike — a user can't remove them by changing filters or opening a link directly.
Before you start
- You need the Analytics Admin role to open and change permissions. See Dashboard users.
- Users you want to restrict must have the analytics agent role in Admin console → Users. Only these users appear on the Permissions page.
- Data access conditions are built from the employee attributes synced into Bot Analytics. Make sure the attributes you want to restrict by (for example Department, Location, Business Unit) are set up in Employee sync.
How it works
- Create a group and choose its feature access.
- Set the group's data access — Full access, or Restricted to employees that match conditions you define.
- Assign users to the group, either while creating it or later from the Users tab.
- Assigned users see Bot Analytics only within the group's limits. Changes take effect within about 30 seconds.
Where to find it
Go to Analytics → Settings → Permissions → Bot platform. The page has two tabs:
| Tab | What it shows |
|---|---|
| Users | Every analytics agent with their Role, Groups mapped, and the effective View custom dashboards, Export data, Metric drilldowns and Data access settings. Search by name or email. |
| Groups | Every permission group with its member count and settings. Search by group name, and create new groups. |
Settings is visible only to Analytics Admins. Other users who open a Permissions link directly see an access-denied page.
Who permissions apply to
| User | Data access | View custom dashboards | Export data | Metric drilldowns |
|---|---|---|---|---|
| Analytics Admin or System Admin | Full access | Allowed | Allowed | Allowed |
| Analytics agent assigned to a group | The group's data access | Group setting | Group setting | Group setting |
| Analytics agent not in any group | Full access | Not allowed | Allowed | Allowed |
Users without a group are not restrictedAn analytics agent who isn't assigned to a group can see data for all employees and can export and open drill-downs. To limit a user, assign them to a group. If you remove a user from a group or delete their group, they return to this baseline.
Admins are always unrestrictedAnalytics Admins and System Admins always have full access and can't be added to a group. If a group member is later promoted to Analytics Admin, their group assignment is kept but ignored; it applies again if the admin role is removed.
Each user can belong to only one group. Settings from different groups are never combined.
Feature access
Feature access controls what members of a group can do in Bot Analytics. All three toggles are off for a new group — turn on only what the group needs.
| Toggle | When on | When off |
|---|---|---|
| View custom dashboards | The user can see custom dashboards and create new ones. | Custom dashboards are hidden from the dashboard list and search, and the user can't create one. Standard Bot Analytics dashboards stay visible. |
| Export data | The user can download data from dashboards and drill-downs as Excel or CSV. | Export options are removed from dashboard cards and drill-downs, and export requests are rejected. |
| Metric drilldowns | The user can open tables and drill-downs that show individual employee rows. | Employee-level drill-downs are removed, and direct requests for them are rejected. The user still sees aggregated metrics. |
Existing sharing and edit rights on individual custom dashboards still apply on top of the View custom dashboards toggle.
Data access
Data access controls which employees' data members of a group can see. Choose one Scope:
- Full access — the user sees data for all employees.
- Restricted — the user sees data only for employees who match the conditions you define under Filters.
When the scope is Restricted, every Bot Analytics metric, chart, table, drill-down and export the user opens is limited to the matching employees. The employee filter dropdowns on dashboards also show only values within the user's scope. Any filters the user applies on a dashboard narrow the data further — they can never widen it.
Building conditions
Each condition has three parts:
| Field | What to choose |
|---|---|
| Attribute | An employee attribute synced into Bot Analytics from Employee sync, for example Department, Location or Grade. |
| Condition | Is any of — include employees whose attribute matches one of the values. Is none of — exclude employees whose attribute matches any of the values. |
| Value | One or more values for the attribute. |
You can combine conditions in two ways:
- And condition adds a condition to the same group. An employee must match all conditions in a group.
- Or group adds a new group of conditions. An employee who matches any one group is included.
Example. To give a regional HRBP team access to Sales and Marketing employees in Bangalore, plus everyone in the Consumer Products business unit:
| Group | Conditions |
|---|---|
| 1 | Department Is any of Sales, Marketing And Location Is any of Bangalore |
| Or 2 | Business Unit Is any of Consumer Products |
The group page shows a Summary of the scope in plain language so you can check it before saving.
Limits
| Item | Maximum |
|---|---|
| Or groups per scope | 10 |
| Conditions per Or group | 10 |
| Values per condition | 500 |
To remove a restriction, switch the scope back to Full access. This clears all conditions.
Create a group
- Go to Analytics → Settings → Permissions → Bot platform → Groups.
- Click Create group.
- On Add details:
- Enter a Group name (up to 50 characters). The name must be unique; admins see it when assigning users.
- Under Feature access, turn on the toggles this group should have.
- Under Data access, choose Full access or Restricted. If Restricted, add at least one complete condition under Filters.
- On Assign users, select the users to add. The list shows only analytics agents who aren't already in another group. You can skip this step and assign users later.
- Click Save.
Assign or move a user
- Go to the Users tab.
- Find the user and open Assign group.
- Select a Group and click Save.
Assigning a user who already belongs to a group moves them to the new group. Clear the group to return the user to the unassigned baseline.
Use the Users tab to move people between groupsThe user picker in a group only lists users who aren't in another group. To move someone from one group to another, use Assign group on the Users tab.
View and edit a group
- On the Groups tab, click a group to open it. The page shows its feature access, data access (with a table of conditions) and assigned users.
- Click Edit to change the name, toggles, scope or members, then click Save.
If another admin changes the same group while you're editing it, saving shows "This group changed while you were editing it. Reload and try again." Reload the page and reapply your changes.
What restricted users see
| Situation | What happens |
|---|---|
| Export data is off and the user tries to export | Export options are hidden. A direct export request shows "You don't have permission to export data. Contact your admin." |
| Metric drilldowns is off and the user opens an employee-level view | The drill-down isn't offered. A direct request shows "You don't have access to employee drilldowns." |
| View custom dashboards is off and the user tries to create a dashboard | "You don't have permission to create dashboards." |
| A restricted user opens a custom metric that can't be limited to their scope | "This custom metric cannot be restricted to your data scope." The metric doesn't load for that user. |
| A restricted user's own filters exclude everyone in their scope | The dashboard shows no data. |
Custom metrics
For a restricted user, a custom metric loads only if its SQL supports population scoping (it includes the {USER_PROFILE_FILTER} placeholder). Built-in Bot Analytics metrics added to custom dashboards are always supported. Users with full access are not affected.
Scheduled report PDFs
Scheduled and manual report PDFs respect permissions:
- The report is generated with the report owner's data access.
- A recipient is skipped if they belong to a group with Restricted data access or with Export data turned off.
Known limitations
- AI Colleague metrics are not yet limited by data access. Restricted users see AI Colleague run-level metrics for all employees.
- The Bot Analytics user list export respects the Export data toggle but is not limited by data access.
- Legacy (non-SQL) Bot Analytics metrics are not limited by data access.
Errors
| Message | What to do |
|---|---|
| A group with this name already exists | Choose a different group name. |
| Analytics admins are unrestricted and cannot be added to a group. | Remove the admin from the selection. Admins always have full access. |
| Some of those users already belong to another group. | Move those users from the Users tab with Assign group. |
| Add at least one condition with an attribute and a value | A Restricted scope needs at least one complete condition. Add one, or switch to Full access. |
| Complete or remove the highlighted condition | Fill in the attribute, condition and value(s) for the highlighted row, or remove it. |
| That attribute isn't available for this bot. | The attribute is no longer synced as a Bot Analytics filter. Check Employee sync or pick another attribute. |
| This scope has too many groups, conditions or values. | Reduce the scope to within the limits. |
| This group changed while you were editing it. Reload and try again. | Another admin saved the group first. Reload and reapply your changes. |
FAQs
How quickly do changes apply?
Within about 30 seconds. Users who have Bot Analytics open may need to refresh the page.
Can I give one user different settings from the rest of their group?
No. Settings are defined per group, and each user belongs to one group. Create a separate group for users who need different access.
Do these permissions affect Helpdesk, Onboarding or other analytics?
No. They apply to Bot Analytics only.
Do permissions change who can access Analytics at all?
No. Access to Analytics is still controlled by dashboard roles in the Admin console. Bot Analytics permissions apply on top of that, to users who already have access.
Related pages
Updated 8 minutes ago
