Which permission put this user on CX 2? Licence attribution, traced to the role

It is the quarterly licence review. Finance has a simple question for the Genesys Cloud administrator: why are 385 voice agents on CX 2 when they only take calls? The administrator opens a user and sees the licence, then opens the agent role and scrolls through a long list of permissions. Somewhere in there, months ago, someone added quality:evaluation:view so agents could see their own evaluations. Nobody connected that one tick box to the tier of every agent who holds the role.

That is the pattern we see again and again: the shared-role trap, permissions added to a default role, supervisor creep, UC-only users who pick up a contact-centre role, and manual licence assignments that outlived a role clean-up. Each is easy to fix once it is found. Finding it, across hundreds of roles and thousands of users, with evidence an auditor can follow, is the hard part. Permissions Auditor exists to make that part routine.

Genesys documents the model clearly. Automatic licence assignment is on by default; each role has an associated licence that reflects the permissions in it; and when you assign a role to a user you are also assigning its licence. The licence a role uses corresponds to the highest-tier permission it contains. In the admin UI, the Edit Role page shows the licence required alongside the permissions and can identify unused permissions in a role, and a user's Divisions & Licenses tab shows their licence and any add-ons.

The Platform API exposes the same model. Licence definitions list every licence available to the organisation; a licence users endpoint returns each user's licences; and POST /api/v2/license/infer returns the licences inferred for a list of role ids. All of this answers questions one role or one user at a time. What an administrator also needs is the join across all of them: for every user, which permission from which role holds them above the next tier down, and how many users each role edit would move.

Each licence definition is a set of permissions. A user's roles grant another set. The question is which licence is the lowest tier whose set covers every licence-relevant permission the user holds. The engine reads the organisation's own licence definitions, expands every permission to concrete domain:entity:action strings against the master permission catalogue, and splits each user's effective permissions three ways: coverable by a base licence, found only in add-on definitions, or neutral platform plumbing that no licence mentions. Only coverable permissions move the base tier; add-on-only permissions attach a named add-on chip instead. That is attribution by permissions: it says which licence a user needs, not what the invoice shows, which depends on the licences actually assigned and the billing model. That is why the audit sets attribution beside assignments and billed quantities rather than treating it as the bill.

The clever part is the downgrade target. The tier ladder is not a chain: a voice agent holding one quality permission above CX 1 should be compared with CX 1, one permission away, not with CX 2 Digital, which their whole voice set would violate. So for each user the engine picks the lower tier needing the fewest removals, and the permissions that tier lacks become the drivers, each traced to the role or roles that grant it, marked sole source when one role edit would demote the user. A floor rule stops clean agents being reported as escalated above the UC-only Communicate licence.

Permissions Auditor signs in with OAuth client credentials and runs one staged, read-only harvest that streams progress live: organisation, licence definitions, the permission catalogue, roles with their permission policies and base licence tags, then users through /api/v2/users with expand=authorization,dateLastLogin and state=any. That expand carries each user's roles and Genesys's own union of their permissions, so no per-user follow-up calls are needed, and inactive users who still hold grants stay visible. Licence assignments, licence inference for each distinct role set, a best-effort billable-usage extract and per-user media counts from the conversation aggregates query complete the picture.

Nothing about tiers is hard-coded. The licence lattice, which licences exist and what each covers, is read live at every harvest, and the mapping of each licence to a category is shown openly so an oddly named licence is visible rather than silently mis-bucketed. Every audit is a timestamped snapshot, so you can re-run after a clean-up and compare. The client is read-only by construction: it refuses every non-GET request before it reaches the network, apart from two allowlisted read-only queries, licence inference and conversation aggregates. A per-session rate limiter, Retry-After back-off on 429 responses and a single token refresh on 401 keep it polite to the platform.

The audit's answer is never shown alone. Each user's attributed tier sits beside the licence Genesys has assigned and the licence Genesys infers for their role set, plus billed quantities where the client may read them. Disagreements become findings rather than being smoothed over, including one aimed at the engine itself: if licence inference names a different base licence for a role set, an engine-disagreement finding says so, treats Genesys as authoritative and offers the drivers as the explanation to check.

There are eight finding kinds. Role escalation and default-role escalation name a role that is the sole source of the permissions holding users above the next tier. Assignment-over and assignment-under catch stale manual assignments in both directions; under-assignment is flagged high severity as true-up exposure, never as a saving. Zombie seats are licence-holding users with no login for 90 days or more. Communicate drift catches UC-only users whose roles now grant contact-centre permissions, and usage rightsizing flags digital-capable tiers that handled no digital interactions in the usage window. The same harvest also lists master admins, role managers who can mint escalations, stale admins and wildcard-heavy roles.

A finished snapshot opens on its Overview: headline tiles for the attributed monthly figure, identified savings, users escalated by role configuration and zombie seats, each drilling through to the page that explains it. The licence mix shows attributed users per tier with the add-on mix beneath, a reconciliation panel sets Genesys-assigned counts beside the billable-usage extract, and Biggest levers lists the top findings, with a clear caveat that savings overlap and any sum is an upper bound.

The Users page is where the evidence lives. Filter by name, attributed tier or add-on, assigned-versus-attributed mismatch or last-login age, then expand a row: every driver permission with its granting role badges, sole source highlighted where one role edit would demote the user, all their roles, the media they handled and Genesys's own inference for their role set. The Roles page scores every role by blast radius, with escalating permissions highlighted in amber against the full expanded list and buttons for the holders and a pre-loaded simulation.

Every finding links to a pre-loaded simulation. Pick a role, then remove it from every holder or untick permissions to strip from it, with the escalating permissions already highlighted and a one-click Strip all escalating permissions. Edit as many roles as you like in one scenario and recompute. The result shows the licence mix before and after, the users who move from one tier to another and the monthly difference at your rate card. Both sides are computed from the same role permission sets, so the difference reflects your edits alone.

In the demo organisation the flagship story is the one from our opening: a shared agent role carrying one quality permission escalates 385 synthetic users, and stripping that single permission in the simulator moves exactly those 385 from CX 2 to CX 1, so the finding and the simulation agree. Nothing is written to Genesys. The output is a change plan for a person to apply in Admin › Roles, under the organisation's own change control, which is precisely where a licence decision belongs.

Permissions Auditor came out of the QVCCS method. Our Senior Business Consultant captured the questions administrators and finance teams ask at licence reviews; the Solution Architect wrote down the attribution rules, the downgrade logic and the floor rule before the engine was built; Senior Developers implemented it as pure functions over each stored snapshot under the Senior Platform Practice Lead's engineering standards; and our Systems Integration Tester proved the engine against Genesys's own licence inference, including an organisation that held add-on upgrades rather than the next base tier. A synthetic demo organisation with every trap planted keeps the whole product testable without customer data.

Money is handled with care. The billable-usage report carries quantities, not prices, so every monetary figure is an editable rate card multiplied by audited counts, badged with its provenance until you enter your own contracted rates, and editing a rate can never change which tier a user lands on. The seven-sheet Excel workbook carries users, drivers, roles, findings, security posture and the rate card used, so the evidence travels with the recommendation. For clients on our managed professional services tiers, it turns a licence review from an argument into a list of specific, reversible role changes.