AWS connect documentation change
Summary
Updated permission descriptions for evaluation forms, clarified singular/plural usage, added a new 'view my received evaluations' permission for agents, and explicitly linked permissions to tag-based access control restrictions.
Security assessment
This change improves documentation around access controls for evaluation forms, explicitly mentioning how tag-based access control restricts viewing. It clarifies security boundaries but does not address a specific security issue.
Diff
diff --git a/connect/latest/adminguide/evaluation-and-coaching-permissions.md b/connect/latest/adminguide/evaluation-and-coaching-permissions.md index d7b4fb0cf..873312231 100644 --- a//connect/latest/adminguide/evaluation-and-coaching-permissions.md +++ b//connect/latest/adminguide/evaluation-and-coaching-permissions.md @@ -10,0 +11,2 @@ To allow users to create, automate, and access evaluation forms, assign the foll + * **Evaluation forms - manage form definitions** : Allows admins and managers to [create](./create-evaluation-forms.html) and [manage](./evaluationform-audit-trail.html) evaluation forms. + @@ -15 +17 @@ This permission allows users to [search](./search-evaluations.html) evaluations - * **View** permissions enable users to view submitted evaluations. You can grant this permissions to users who perform evaluations (such as managers) and users (such as agents) who need to view evaluations. + * **View** permission enables users to view submitted evaluations. This permission enables users to see evaluations on any contacts they have access to (unless [restricted by tag-based access control](https://docs.aws.amazon.com/connect/latest/adminguide/tag-based-access-control-performance-evaluations.html)). You can grant this permission to users who perform evaluations (such as managers). @@ -17 +19 @@ This permission allows users to [search](./search-evaluations.html) evaluations - * **Create** permissions enable users to create new evaluations, view and edit draft evaluations. + * **Create** permission enables users to create new evaluations, view and edit draft evaluations. @@ -19 +21 @@ This permission allows users to [search](./search-evaluations.html) evaluations - * **Edit** permissions enable users to edit submitted evaluations. + * **Edit** permission enables users to edit submitted evaluations. @@ -21 +23 @@ This permission allows users to [search](./search-evaluations.html) evaluations - * **Delete** permissions enable users to delete both draft and submitted evaluations. + * **Delete** permission enables users to delete both draft and submitted evaluations. @@ -23 +25 @@ This permission allows users to [search](./search-evaluations.html) evaluations - * **Evaluation forms - manage form definitions** : Allows admins and managers to [create](./create-evaluation-forms.html) and [manage](./evaluationform-audit-trail.html) evaluation forms. + * **Evaluation forms - view my received evaluations** : Allows agents to search for and view completed evaluations that they have received. This does not grant access to evaluations in draft, under review or part of calibrations. Access to an evaluation will be subject to [tag-based access control ](https://docs.aws.amazon.com/connect/latest/adminguide/tag-based-access-control-performance-evaluations.html).