Permissions (RBAC)

Bot Analytics Permissions

Bot Analytics permissions let Analytics Admins control two things for every dashboard user: what they can do in Bot Analytics (view custom dashboards, export data, open employee-level drill-downs) and which employees' data they can see (all employees, or only a subset such as one region or business unit).

You manage permissions through groups. You define the feature access and data access once on a group, then assign users to it. Restrictions are enforced on the server for every Bot Analytics query, so they apply to dashboards, drill-downs and exports alike — a user can't remove them by changing filters or opening a link directly.

📘

Before you start

  • You need the Analytics Admin role to open and change permissions. See Dashboard users.
  • Users you want to restrict must have the analytics agent role in Admin console → Users. Only these users appear on the Permissions page.
  • Data access conditions are built from the employee attributes synced into Bot Analytics. Make sure the attributes you want to restrict by (for example Department, Location, Business Unit) are set up in Employee sync.

How it works

  1. Create a group and choose its feature access.
  2. Set the group's data access — Full access, or Restricted to employees that match conditions you define.
  3. Assign users to the group, either while creating it or later from the Users tab.
  4. Assigned users see Bot Analytics only within the group's limits. Changes take effect within about 30 seconds.

Where to find it

Go to Analytics → Settings → Permissions → Bot platform. The page has two tabs:

TabWhat it shows
UsersEvery analytics agent with their Role, Groups mapped, and the effective View custom dashboards, Export data, Metric drilldowns and Data access settings. Search by name or email.
GroupsEvery permission group with its member count and settings. Search by group name, and create new groups.

Settings is visible only to Analytics Admins. Other users who open a Permissions link directly see an access-denied page.

Who permissions apply to

UserData accessView custom dashboardsExport dataMetric drilldowns
Analytics Admin or System AdminFull accessAllowedAllowedAllowed
Analytics agent assigned to a groupThe group's data accessGroup settingGroup settingGroup setting
Analytics agent not in any groupFull accessNot allowedAllowedAllowed
🚧

Users without a group are not restricted

An analytics agent who isn't assigned to a group can see data for all employees and can export and open drill-downs. To limit a user, assign them to a group. If you remove a user from a group or delete their group, they return to this baseline.

📘

Admins are always unrestricted

Analytics Admins and System Admins always have full access and can't be added to a group. If a group member is later promoted to Analytics Admin, their group assignment is kept but ignored; it applies again if the admin role is removed.

Each user can belong to only one group. Settings from different groups are never combined.

Feature access

Feature access controls what members of a group can do in Bot Analytics. All three toggles are off for a new group — turn on only what the group needs.

ToggleWhen onWhen off
View custom dashboardsThe user can see custom dashboards and create new ones.Custom dashboards are hidden from the dashboard list and search, and the user can't create one. Standard Bot Analytics dashboards stay visible.
Export dataThe user can download data from dashboards and drill-downs as Excel or CSV.Export options are removed from dashboard cards and drill-downs, and export requests are rejected.
Metric drilldownsThe user can open tables and drill-downs that show individual employee rows.Employee-level drill-downs are removed, and direct requests for them are rejected. The user still sees aggregated metrics.

Existing sharing and edit rights on individual custom dashboards still apply on top of the View custom dashboards toggle.

Data access

Data access controls which employees' data members of a group can see. Choose one Scope:

  • Full access — the user sees data for all employees.
  • Restricted — the user sees data only for employees who match the conditions you define under Filters.

When the scope is Restricted, every Bot Analytics metric, chart, table, drill-down and export the user opens is limited to the matching employees. The employee filter dropdowns on dashboards also show only values within the user's scope. Any filters the user applies on a dashboard narrow the data further — they can never widen it.

Building conditions

Each condition has three parts:

FieldWhat to choose
AttributeAn employee attribute synced into Bot Analytics from Employee sync, for example Department, Location or Grade.
ConditionIs any of — include employees whose attribute matches one of the values. Is none of — exclude employees whose attribute matches any of the values.
ValueOne or more values for the attribute.

You can combine conditions in two ways:

  • And condition adds a condition to the same group. An employee must match all conditions in a group.
  • Or group adds a new group of conditions. An employee who matches any one group is included.

Example. To give a regional HRBP team access to Sales and Marketing employees in Bangalore, plus everyone in the Consumer Products business unit:

GroupConditions
1Department Is any of Sales, Marketing And Location Is any of Bangalore
Or 2Business Unit Is any of Consumer Products

The group page shows a Summary of the scope in plain language so you can check it before saving.

Limits

ItemMaximum
Or groups per scope10
Conditions per Or group10
Values per condition500

To remove a restriction, switch the scope back to Full access. This clears all conditions.

Create a group

  1. Go to Analytics → Settings → Permissions → Bot platform → Groups.
  2. Click Create group.
  3. On Add details:
    1. Enter a Group name (up to 50 characters). The name must be unique; admins see it when assigning users.
    2. Under Feature access, turn on the toggles this group should have.
    3. Under Data access, choose Full access or Restricted. If Restricted, add at least one complete condition under Filters.
  4. On Assign users, select the users to add. The list shows only analytics agents who aren't already in another group. You can skip this step and assign users later.
  5. Click Save.

Assign or move a user

  1. Go to the Users tab.
  2. Find the user and open Assign group.
  3. Select a Group and click Save.

Assigning a user who already belongs to a group moves them to the new group. Clear the group to return the user to the unassigned baseline.

👍

Use the Users tab to move people between groups

The user picker in a group only lists users who aren't in another group. To move someone from one group to another, use Assign group on the Users tab.

View and edit a group

  1. On the Groups tab, click a group to open it. The page shows its feature access, data access (with a table of conditions) and assigned users.
  2. Click Edit to change the name, toggles, scope or members, then click Save.

If another admin changes the same group while you're editing it, saving shows "This group changed while you were editing it. Reload and try again." Reload the page and reapply your changes.

What restricted users see

SituationWhat happens
Export data is off and the user tries to exportExport options are hidden. A direct export request shows "You don't have permission to export data. Contact your admin."
Metric drilldowns is off and the user opens an employee-level viewThe drill-down isn't offered. A direct request shows "You don't have access to employee drilldowns."
View custom dashboards is off and the user tries to create a dashboard"You don't have permission to create dashboards."
A restricted user opens a custom metric that can't be limited to their scope"This custom metric cannot be restricted to your data scope." The metric doesn't load for that user.
A restricted user's own filters exclude everyone in their scopeThe dashboard shows no data.

Custom metrics

For a restricted user, a custom metric loads only if its SQL supports population scoping (it includes the {USER_PROFILE_FILTER} placeholder). Built-in Bot Analytics metrics added to custom dashboards are always supported. Users with full access are not affected.

Scheduled report PDFs

Scheduled and manual report PDFs respect permissions:

  • The report is generated with the report owner's data access.
  • A recipient is skipped if they belong to a group with Restricted data access or with Export data turned off.

Known limitations

  • AI Colleague metrics are not yet limited by data access. Restricted users see AI Colleague run-level metrics for all employees.
  • The Bot Analytics user list export respects the Export data toggle but is not limited by data access.
  • Legacy (non-SQL) Bot Analytics metrics are not limited by data access.

Errors

MessageWhat to do
A group with this name already existsChoose a different group name.
Analytics admins are unrestricted and cannot be added to a group.Remove the admin from the selection. Admins always have full access.
Some of those users already belong to another group.Move those users from the Users tab with Assign group.
Add at least one condition with an attribute and a valueA Restricted scope needs at least one complete condition. Add one, or switch to Full access.
Complete or remove the highlighted conditionFill in the attribute, condition and value(s) for the highlighted row, or remove it.
That attribute isn't available for this bot.The attribute is no longer synced as a Bot Analytics filter. Check Employee sync or pick another attribute.
This scope has too many groups, conditions or values.Reduce the scope to within the limits.
This group changed while you were editing it. Reload and try again.Another admin saved the group first. Reload and reapply your changes.

FAQs

How quickly do changes apply?
Within about 30 seconds. Users who have Bot Analytics open may need to refresh the page.

Can I give one user different settings from the rest of their group?
No. Settings are defined per group, and each user belongs to one group. Create a separate group for users who need different access.

Do these permissions affect Helpdesk, Onboarding or other analytics?
No. They apply to Bot Analytics only.

Do permissions change who can access Analytics at all?
No. Access to Analytics is still controlled by dashboard roles in the Admin console. Bot Analytics permissions apply on top of that, to users who already have access.

Related pages


Did this page help you?