Explore Subpermissions feedback: restricting ticket data visibility

Please give a quick overview of your product feature request or feedback and note who in your org is affected by this issue [ex. agents, admins, customers, etc.]. (2-3 sentences)

There was a recent announcement for the subpermissions to restrict reporting capabilities by group. One of the other  concerns we had with this announcement was it was stated it was announced in September but we didn't get the communication (4 others even from other companies confirmed the same). Please comment on this article if you did or did not receive this communication in September

There are a few features missing with this launch:

1. Ability to have a single role but split this subpermission by Team
2. Ability to still report on submitted tickets regardless of Brand/Group
3. Add restrictions based on Brand, not just Group
4. Ability to exclude groups/brands

This impacts everyone that has Explore reporting capability. We need to be able to restrict Teams to report on their own Brand, exclude private groups from all roles except for a few. We have about 20+ roles and if we need to break up a role by Team based on this subpermission, this requires a minimum of 3 of the same roles.

What problem do you see this solving? (1-2 sentences) 

1. Ability to have a single role but split this subpermission by Team
   1. We have 4 different Teams within one instance. They share one of the 20 roles. If we start restricting reporting capabilities, we have to split up the role for each team to ensure they can continue reporting on their Teams tickets and not others.
2. Ability to still report on submitted tickets regardless of Brand/Group
   1. We have individuals that report on tickets their team has submitted to IT or even report on tickets they have submitted. If we restrict only IT to report on IT tickets and no one else can, they will no longer be able to see the volume they have submitted.
3. Add restrictions based on Brand, not just Group
   1. We add groups regularly and if we set up roles to only report on groups for their Brand, we have to update each role with this restriction (10+ roles every time a group is created).  This is currently a blocker for implementing as there are 20+ people that can create groups as part of projects. We can't expect them to update a role everytime - too much manual effort.
4. Ability to exclude groups/brands
   1. There are some roles that should only be able to report on Private groups for PII reasons. None of the other roles should be able to report on these groups. If we are to restrict this capability for the other Roles, we can't exclude so we have to INCLUDE ALL the groups they CAN report on (10-50 groups).

When was the last time you were affected by this lack of functionality, or specific tool? What happened? How often does this problem occur and how does this impact your business? (3-4 sentences)

This functionality has been missing for so long, we have needed to adapt but now that it is available, we still can't utilize it. Right now there is not a push to implement restrictions but that can change so we hope the missing features will be implemented before then

Are you currently using a workaround to solve this problem? (If yes, please explain) (1-2 sentences)

Right now we have limited which roles can report in Explore to limit visibility to reduce the chance of reporting on other teams. We have to go off of the honor system to ensure they aren't reporting on other Teams tickets. In one case, we had to move a team to another instance so they can't have their data reported on by other teams. We currently cannot implement this feature due to the lack of future proofing updates with new groups being added

What would be your ideal solution to this problem? How would it work or function? (1-2 sentences)

1. Ability to have a single role but split this subpermission by Team
   1. If we had the ability to select a different condition to restrict reporting abilities. Imagine User Segments based on Tag/Group to determine what data they can report on rather than increasing the amount of roles. ie. Roles with this tag can report on this, roles with this tag can do that. This would reduce the amount of roles we need to maintain and have our team memorize as to what accomplishes what.
2. Ability to still report on submitted tickets regardless of Brand/Group
   1. If there was a way to allow for certain types of tickets submitted to groups - tag tickets they can access etc. Currently they can view tickets they follow or submit on their profile or Agent Home - but it wouldn't be able to be reported on/exported
3. Add restrictions based on Brand, not just Group
   1. If we can restrict subpermissions to Brand (just like with Groups), this will future proof the role subpermissions and reduce human error
4. Ability to exclude groups/brands
   1. If we can exclude, we would only need to edit the 19 roles of the 20 roles to exclude reporting on the 4 groups. Rather than editing all 60 roles to report on the 10-50 groups (we would need to create 3 of each role to ensure each team reports on only their own tickets

Related article: Announcing updates to Explore permissions – Zendesk help