OOB they are already restricted, if created from HR Agent Workspace. The read ACL for interaction table is limited to those with case_reader role, if the Application is "Agent Workspace for HR Case Management". What application scope are your HR chat records being created in? Validate the read ACL on that application scope to confirm who has access today and what changes may be necessary. If they are being created in global, be sure not to impact other department's access to their interaction records.
