C3 AI Documentation Home

Agent Lifecycle Management Roles and Permissions

Agent Lifecycle Management uses role-based access control to manage who can create, modify, deploy, and manage agents. The system defines permissions across three role categories, with different access levels for agent drafts, agents in the store, and deployed agents.

General roles

General roles include C3.Developer and GenaiCore.BaseUser, and similar platform roles. Users with these roles can create agents and view any agent in the Gallery or Workbench. They can modify, chat with, or delete only the agents they created.

AgentAdmin

The GenaiCore.AgentAdmin role provides full access to manage any agent in the system. Users with this role can modify, chat with, and delete agents created by any user. This role supports team leads and senior developers who need to assist others without requiring full application administrator access.

AppAdmin

The C3.AppAdmin role provides complete system access with no restrictions. Users with this role can deploy agents, manage deployments, access preview deployments, and perform any operation in Agent Lifecycle Management.

Agent draft permissions

Agent drafts are agents under development in the Workbench. The following table shows which operations each role can perform on agent drafts.

ActionC3.Developer, GenaiCore.BaseUserGenaiCore.AgentAdminC3.AppAdmin
Create Agent✓✓✓
Duplicate AgentAny AgentAny AgentAny Agent
View Agent in GalleryAny AgentAny AgentAny Agent
View Agent in WorkbenchAny AgentAny AgentAny Agent
Modify AgentAgent Creator OnlyAny AgentAny Agent
Chat with AgentAgent Creator OnlyAny AgentAny Agent
Delete AgentAgent Creator OnlyAny AgentAny Agent
View Traces in WorkbenchAgent Creator OnlyAny AgentAny Agent

Users with C3.Developer and GenaiCore.BaseUser can invoke traces only for agents they created. For read-only agents, the trace view appears empty.

Agent store permissions

The Agent Store contains non-draft agents that are available for deployment. The following table shows which operations each role can perform on agents in the store.

ActionC3.Developer, GenaiCore.BaseUserGenaiCore.AgentAdminC3.AppAdmin
View Agent in GalleryAny AgentAny AgentAny Agent
View Agent in WorkbenchAny AgentAny AgentAny Agent
Modify Agent×××
Chat with AgentAgent Creator OnlyAny AgentAny Agent
Delete AgentAgent Creator OnlyAny AgentAny Agent
View Traces in WorkbenchAny AgentAny AgentAny Agent

No role can modify agents in the store. To update a non-draft agent, duplicate it to create a draft, make changes, and publish the updated version.

Agent deployment permissions

Agent deployments are agents running in production or test environments. The following table shows which operations each role can perform on deployed agents.

ActionC3.Developer, GenaiCore.BaseUserGenaiCore.AgentAdminC3.AppAdmin
View Deployment in Deployments PageAny DeploymentAny DeploymentAny Deployment
View Deployment in WorkbenchAny DeploymentAny DeploymentAny Deployment
Deploy Agent×Any AgentAny Agent
Update Deployment Version×Any AgentAny Agent
Enable/Disable Deployment×Any AgentAny Agent
Chat with AgentAny AgentAny AgentAny Agent
Terminate Deployment×Any AgentAny Agent
View Deployment MetricsAny AgentAny AgentAny Agent
View Traces In WorkbenchAny AgentAny AgentAny Agent
View Traces In Deployments PageAny AgentAny AgentAny Agent
View Preview Deployment××Any Agent
Terminate Preview Deployments××Any Agent

Only GenaiCore.AgentAdmin and C3.AppAdmin roles can deploy, update, or terminate agent deployments. Users with C3.Developer and GenaiCore.BaseUser can view and test deployments.

Assign users to roles

To assign users to Agent Lifecycle Management roles, follow the steps in Assign Users.

Role changes apply immediately. Refresh your browser to see updated permissions.

Best practices

Apply these practices when managing Agent Lifecycle Management roles:

  • Assign minimum required access: Start users with C3.Developer and GenaiCore.BaseUser and expand access only when their responsibilities require it.
  • Grant GenaiCore.AgentAdmin to team leads or senior developers who support other team members.
  • Limit C3.AppAdmin assignments: Reserve C3.AppAdmin for operations staff who manage production environments.
  • Review assignments regularly: Audit role assignments each quarter to match current team structure and responsibilities.
  • Document elevated permissions: Record why users received GenaiCore.AgentAdmin or C3.AppAdmin access for compliance and knowledge transfer.
  • Separate development and production: Consider using different role assignments for development and production environments.

C3.AppAdmin and GenaiCore.AgentAdmin provide unrestricted access to all Agent Lifecycle Management operations, including deploying and terminating production agents. Assign this role only to experienced administrators who understand operational impact.

See also

Was this page helpful?