Permission contexts

Company > Users > Roles > Permission Contexts

Permission contexts supplement and override account and Role permissions, but only in the specific context in which they are applied. Unlike other areas of access control that combine to restrict access, this is a place where permissions can be granted beyond what the user would normally be allowed to see. They can also be used to limit the data set when viewed in specific conditions.

The specific data a role can see is a subset of the "additional data when in context"

The most common use case for permission contexts allows users to view data that would otherwise require an unacceptably broad data access relative to their role. For example, Store Managers in a retail environment might want to see how they rank against other stores, but it may be inappropriate for a Store Manager to be able to drill down to data for employees at other stores.

In this case, a Store Manager's data access for their account is probably their own store. To allow the managers to see how their stores rank, a permission context is configured to allow broader access, such as to "All Stores". Then that context is assigned to the Ranker tab for "Stores" to allow the store managers to see store rankings without giving them broad access to more detailed store data. Alternatively, to allow the managers to see a subset of stores, such as only the ones in their own region, the permission context would be limited to the value for their region segment.

Permission contexts can also be used to limit data access. For example, if data access is very broad but a particular report is intended to focus on a subset of that data access, the permission context would contain a value for data access that is actually more restrictive than the value used for overall account access.

Once the permissions are assigned to a context, you can use the context in a

  • custom report by assigning to the report using the report's Permission Context property.
  • standard report by creating a Context Assignment, that associates the Role, context, and report.
Specific permissions are assigned to a role; permission contexts are supplemental and affect what the role can see
Note: For a complete discussion of access control and permission contexts, see Roles, permissions, and capabilities.

Properties

This screen creates and manages Permission Context objects. Other screens assign permissions and associate contexts with Roles, permissions, and reports.

Name
Name of the Permission Context object.
Description
Optional description of the purpose of the context.
Minimum Sample Size
This property determines how many responses are required for reports in Medallia Alchemy Experience Reporting to have access to customer-identifying information for the selected permission context. If the number of responses is equal to or above the number you set, identifying information is available to reports. If the number of responses is lower than the number you set, identifying information is not available. This property should be used, for example, with Voice of the Employee programs.

When the sample size for a single field falls below the minimum, that data in reports is replaced by two asterisks (**). When the sample size for an entire segment falls below the minimum, the entire row or column is hidden in reports.

This property affects data at the API level, making it different from the Minimum Sample Size property for report modules in Medallia Admin Suite. That property limits the display of scores to ensure statistical validity in reports, and does not specifically make customer-identifying information unavailable.

Company
Company name. Only roles for this company will be able to use this context.

Creating and using permission contexts

To create and use permission contexts:

  1. Create the context on the Permission Contexts screen. This creates the object only, but does not assign permissions or permitted uses.
  2. Assign the context to one or more standard reports or Ranker on the Context Assignments screen.

    1. Several default reporting modules (e.g., Satisfaction, Ranker) can be set on this screen.

    2. The Ranker reports setup screen allows selection of a permission context for each selected rank field.

    3. Dashboards allow permission contexts to be applied in two places: at he parent dashboard level and at the child dashboard module level. For more information about configuring dashboards, see Dashboards.

  3. Reference the context in a custom report.
    1. Use the Permission Context property.
    2. To apply a context to an entire report, select it from a dropdown on the AA2 setup screen, or on a dashboard module that is using that report.
    3. To use a context within an AA2 report, use the <permission-context name="Insert Permission Context Name Here"/> node. This node behaves differently depending on usage, see the XML documentation for details.
  4. For Roles that will use the context, assign the context to the role on the Roles screen. Otherwise, the permissions assigned to the context can apply to the entire company.
  5. Grant the specific permissions to the context on the Permission by Segment screen.

To test the configuration:

  1. Manually create a test user and set the data access as desired. For example, in the store manager use case, set overall data access to a single store, and set the permission context access to either a larger subset of stores or all stores.

  2. Use the test user account to view the reporting area you've applied the context to. Verify that the report is rendering properly and that the scores are accurate.

To automate setting permission contexts during the user account creation process, set the permissions when importing the account data. The user file will either need to contain a data point for each user that indicates the permission context, or there will need to be logic in the auto importer specification that provides a value to set. See Setting access permissions with Auto Importer for details.