ABAC: Using Access Control Groups (ACGs) in Alerts

What this article covers

• How ACGs determine who can manage and send alerts in the intranet.
• How to select sub-audiences within a scoped alert audience.
• What different user roles (Manager, Admin, Feature Owner) can see and do.

Role of ACGs in the alerts feature

Access Control Groups (ACGs) enforce granular permissions in the Alerts module by controlling:

1. Who can manage alerts.
2. What audience(s) those alerts can be sent to.

Example: Amber Rich assigned as alert manager

• Amber is added as a scoped manager to an ACG for the Manager Resources site.
• This ACG has a scoped audience of 823 users (site members).
• Amber now:
  • Can view alerts targeted to that site audience.
  • Can create new alerts only for Manager Resources site members.

Step-by-step: Creating an alert with ACG restrictions

1. Log in as a scoped manager.
2. Navigate to Alerts.
3. Click Create new alert.
4. Choose Target audience.
   • The list of audiences shown is limited by your ACG.
   • You can:
     • Select the full audience (e.g., all site members).
     • Create a sub-audience using filters like department, location, etc.
5. Compose and configure the alert (title, message, delivery method).
6. Send the alert.

The scoped manager only sees alerts sent to their scoped audience—even if they were created by another manager or admin.

Managing alerts and audiences

Scoped managers can:

• View and manage alerts that fall within their audience scope
• Filter alerts by the audience used in the alert
• Create sub-audiences to send targeted alerts within their maximum scope

They cannot:

• Create alerts for any audience outside of their ACG
• View alerts or audience data beyond their permission scope

Example: All org vs scoped users

System ACGs exist as fallbacks for All org alerts and are only editable by high-level roles like app managers or global admins.

Key takeaways

• ACGs strictly control alert visibility and audience targeting.
• Scoped managers can narrow down audiences, but never broaden beyond their defined scope.
• Global users (App Managers, Feature Owners) have full visibility and access to All org toggles.
• Users can only manage alerts that fall within their defined audience permissions.