Ticket Group Permissions

Jason He Updated by Jason He

A new feature called "User Group" was released in admin console version 1.26. This makes grouping tickets easier compared to using group tags as discussed in this guide. Click this link for more information about user groups.

In the past, we used permissions to allow users to access all tickets that belong to their company. While the All tickets option is suitable for managers and administrators, it does not cover specific cases such as HR or Procurement related tickets.

This is where our ticket Group permissions come into rescue.

With ticket group permissions, you can group up tickets and allow users who have access to that group to see its related tickets. You can also group events used to restrict approver's permissions.

In this article we will cover two topics.

  • Assigning tickets to a specific group
  • Giving group permission to a specific user

What is a Group? How do we define it ?

With our current implementation, a group is formed using tags.

Any tag that starts with the group- prefix will be treated as a group tag by the system

Please note that a group tag under different entity has a different meaning.

  • Request type with a group tag: Group tags can be added to request types. Tickets created by this request type will inherit the group tag(s) added to it.
  • Form with a group tag: Group tags can be added to specific forms. Tickets created by this form will inherit the group tag(s) added to it
  • Ticket with a group tag: Inherited from request types/forms or can be added manually via the Tech Portal. Only user with "All Tickets" permission or with the same group tag can access these tickets.
  • Contacts (users) with a group tag: Group tags can be added to specific users.
    • User with all tickets (plus group tag): can access all tickets
    • User without all tickets (plus group tag): can access their own ticket, plus tickets related to that specific group tag
    • Approver with all tickets (plus group tag): can access all tickets but this approver can only approve tickets under the group they have access to
    • Approver without all tickets (plus group tag): can access their own ticket, plus tickets related to that specific group tag. This approver can only approve tickets under the group they have access to.
  • Company: Group tag does not apply to Companies
  • Member: Group tag does not apply to Members

Assigning Tickets to a Group

There are two ways on how assign group tag for a ticket:

First scenario (Request Types and Forms): if any given form or request type contains a group tag, any ticket created from them will automatically inherit the same tags.

Second scenario (manually assign in Tech Portal): members can manually add any tags to a given ticket in Ticket Details (side menu, bottom left).

Restrict Contact with Group

To restrict a contacts' ticket access permission, you can assign group tags to the contact via the admin console.

Add a tag, e.g. group-hr, to that user to restrict their ticket access.

REMEMBER: Contacts (users) with a group tag: Group tags can be added to specific users.

- User with all tickets: can access all tickets
- User without all tickets: can access their own ticket, plus tickets related to that specific group tag
- Approver with all tickets: can access all tickets but this approver can only approve tickets under the group they have access to
- Approver without all tickets: can access their own ticket, plus tickets related to that specific group tag. This approver can only approve tickets under the group they have access to.

Additional Info and Comments from the Devs

Using tags as permission tooling is not explicit. No one will expect that tags can be used to tune permissions.

Tag's behavior is not obvious nor explicit. Group tag on different entities has different meaning, which is a bad pattern. A feature needs to be obvious and easy to learn without documentation.

Group tags on Request Type or DD Forms cannot be used to restrict users. Since its meaning conflict itself. e.g. group-hr can mark ticket only accessible by user from group-hr. If it also restricts on Request Types, it means only user from HR with the same tag at contact level can create ticket that's submit to HR.

FAQs:

Q: Why does the group concept use the tag system?

A: At current stage, tag has similar concept as group, which is a short cut that we can use to achieve this feature.

Q: Is this beta or experimental feature?

A: This is experimental, but different to other experimental feature, we are committing to long term support on this.

Q: Will group tag ever change to its own system?

A: With all probability. The current tag system has several limitations that we want to overcome in the long run. Once we decide to separate it from tag system, we will migrate all your existing settings.

How did we do?

Exporting Contacts as CSV

Contact Impersonation

Contact