Audit trail

Role-based access control (RBAC) is an access model where permissions attach to defined roles rather than to individual users. Users inherit access by being assigned to a role. This keeps permissions aligned with job function and supports the principle of least privilege: each role grants only what it needs, no more. Poorly maintained RBAC systems often accumulate overlapping or redundant roles faster than anyone prunes them, a pattern sometimes called role explosion. Role definitions need regular review alongside joiner-mover-leaver changes as staff join, switch teams, or exit. In customer service, RBAC lets a QA reviewer read every conversation transcript for evaluation while a frontline agent sees only the tickets in their own queue. A well-scoped RBAC setup also limits the blast radius if one account is compromised, since that account only ever had access to its own role's data.

Maker-checker, also known as the four-eyes principle, is a control requiring that one person create or change a record (the maker) and a different person review and approve it (the checker) before it takes effect. The principle comes from banking operations. It enforces segregation of duties so no single individual can both initiate and authorize an action. This reduces error and fraud risk without slowing down routine, low-value transactions. In customer service, a common application is refund approval: an agent issues a goodwill credit, but any amount above a set threshold requires a supervisor's sign-off before it is processed. The same pattern applies to policy changes, bulk data exports, and configuration updates in a support platform.

A data retention policy is the documented set of rules governing how long each category of data is kept, where it is stored, and how it is deleted or anonymised once that period ends. It rests on purpose limitation: data should be retained only as long as the original business or legal purpose requires, not indefinitely. Legal holds can pause scheduled deletion during litigation or investigation. Retention is distinct from backup cycles, which preserve copies for disaster recovery rather than active use. In customer service, a contact centre might delete raw call recordings after a set period while retaining anonymised QA scores for long-term trend reporting. See data residency for where that retained data is stored.

QA calibration is a recurring exercise in which multiple evaluators independently score the same customer interaction against the same agent scorecard, then compare results and reconcile any gaps. Sessions typically run on a regular cadence to catch rubric ambiguity before it spreads and to keep evaluators aligned as scorecards evolve. Success gets measured by inter-rater reliability: how closely scores converge across reviewers. Calibration is necessary because manual QA relies on small, sampled reviews, where individual judgment drifts over time and across reviewers. Applying one rubric automatically across every conversation, as OnClarity’s AI Agent QA does, removes evaluator-to-evaluator drift by design.

Human in the loop describes a review step where a person approves or corrects AI output before it reaches the customer. Teams typically apply it to high-risk intents such as refunds, cancellations, and complaints, then relax it selectively as measured accuracy on those intents proves out.