Roles and Permissions
Access to C3 AI Agentix is governed by three core roles that form an administration ladder. Most people need just one, Agentix.User, to chat with agents, run their own automations, manage their own skills and connections, and view their own usage. Two administrator roles layer on top of it: Agentix.AgentAdmin for the people who curate agents and watch the fleet, and Agentix.AppAdmin for the people who operate the environment itself. Optional capability entitlements, such as Agentix.LlmApiUser, layer on Agentix.User without becoming administrator rungs.
This page lists the C3 AI Agentix roles, spells out exactly what each one permits, explains how they nest, and shows how they shape what each user sees.
The C3 AI Agentix roles
The three core roles in this table form a strict ladder—each one includes everything the role above it can do. Agentix.LlmApiUser is a separate bulk entitlement for personal LLM API access; it nests Agentix.User but doesn't grant Agentix.AgentAdmin capabilities:
| Role | What it's for |
|---|---|
Agentix.User | The base role for everyone who uses the app: chat with agents, run and manage your own automations, manage your own skills and chat sessions, manage your own connections (personal secrets and MCP servers), use applications an admin has connected, and view your own Usage. |
Agentix.AgentAdmin | The agent administrator. Nests Agentix.User and adds the agent-administration surface: create, edit, and delete agents; view the Monitor dashboard and Observability traces; provision, rotate, test, and clear the service-account tokens for other clusters; and manage the shared external MCP connection registry. |
Agentix.AppAdmin | The C3 AI Agentix environment administrator. Nests Agentix.AgentAdmin (and therefore Agentix.User) and adds the fleet-level controls: warm-pool sizing, forcing a Sync, acting on any user's session, and promoting skills or connections to a cluster-wide (Global) scope. It grants these without requiring a platform admin role. |
| Platform administrator | A C3 AI Platform-level administrator (C3.AppAdmin, C3.EnvAdmin, or C3.ClusterAdmin). Satisfies the same admin gate as Agentix.AppAdmin, so it can do everything in C3 AI Agentix plus the platform operations that sit outside the app. |
Agentix.AppAdminis a C3 AI Agentix-scoped role, not a platform role. It exists so warm-pool tuning and session administration can be delegated at the C3 AI Agentix level without handing out platformC3.AppAdmin. Internally, bothAgentix.AppAdminand the platform admin roles satisfy the same check (isAtLeastAppAdmin), which is why they share the top row of every table on this page.
What each role can do
The roles nest, so each column below includes everything to its left. A platform administrator can do everything Agentix.AppAdmin can, plus platform-level operations.
| Capability | Agentix.User | Agentix.AgentAdmin | Agentix.AppAdmin |
|---|---|---|---|
| Chat with agents; connect apps to a chat; manage your own workspace and sessions | ✓ | ✓ | ✓ |
| Browse the Agents gallery and agent detail | ✓ | ✓ | ✓ |
| Browse the Skills catalog; upload Personal skills; attach skills to your own chats | ✓ | ✓ | ✓ |
| Create and manage your own automations (asynchronous agent jobs) | ✓ | ✓ | ✓ |
| Manage your own connections: personal secrets and your own MCP servers | ✓ | ✓ | ✓ |
| Use a cross-cluster app an admin has already connected | ✓ | ✓ | ✓ |
| View your own Usage (your tokens and spend) | ✓ | ✓ | ✓ |
| View API access and manage your own Nexus LLM keys when access is enabled | ✓ | ✓ | ✓ |
| Create, edit, and delete agents | — | ✓ | ✓ |
| View the Monitor dashboard and Observability (Laminar) traces | — | ✓ | ✓ |
| Provision, rotate, test, or clear cross-cluster service-account tokens | — | ✓ | ✓ |
| Manage the shared external MCP connection registry | — | ✓ | ✓ |
| Promote a skill or connection to Global (cluster-wide); edit or delete a Global one | — | — | ✓ |
| Manage agent services fleet-wide: stop, resume, or terminate any user's session | — | — | ✓ |
| Configure the warm pool and force a Sync on the Admin dashboard | — | — | ✓ |
| Enable, revoke, suspend, or restore another user's Nexus LLM API access | — | — | ✓ |
Two boundaries deserve emphasis because users can infer them incorrectly:
Agentix.AgentAdmindoesn't get the fleet-level controls. It can open the Admin and Services pages, but warm-pool sizing, forcing a Sync, and acting on another user's session all requireAgentix.AppAdmin(or a platform admin). On the dashboard, a plainAgentix.AgentAdminstill sees only its own sessions.- Promoting to Global is an
Agentix.AppAdminaction, not anAgentix.AgentAdminone. Creating a Global skill or a cluster-wide connection changes what everyone gets, so it sits at the top of the ladder alongside the other fleet-wide controls.
Self-service is built in for everyone. A
Agentix.Useralready manages their own chats, sessions, automations, and connections directly—starting and deleting chats, scheduling automations, storing personal secrets, and connecting their own MCP servers. The admin controls are for managing the whole fleet (everyone's instances) or cluster-wide resources, which is why they require an administrator.
Role-gated navigation
What a user sees in the left navigation follows directly from their role:
| Nav item | Visible to |
|---|---|
| Chat, Agents, Skills, Automations, Usage, Connect | Everyone (Agentix.User and up) |
| Monitor | Agentix.AgentAdmin, Agentix.AppAdmin, platform admins |
| Admin | Agentix.AgentAdmin, Agentix.AppAdmin, platform admins |
The Admin page is visible to any agent admin, but the fleet-level actions on it (warm-pool sizing, force Sync, acting on another user's session) still require Agentix.AppAdmin or a platform admin, as described above.
Assigning roles
Most roles are granted through the C3 AI Platform's access control. An administrator assigns one or more Agentix.* roles (typically Agentix.User for everyone, plus an admin role for the few who need it) to a user or a group, using your environment's standard role-management tooling.
A practical baseline:
- Grant
Agentix.Userto all product users—it's the role that lets people use the product. - Grant
Agentix.AgentAdminto the people who curate the shared agents, watch usage and cost on Monitor, and provision cross-cluster connections. - Grant
Agentix.AppAdminsparingly—only to those who run the service fleet, tune the warm pool, and manage cluster-wide (Global) skills and connections. - Reserve platform-administrator rights for the small group that operates the cluster itself.
Best practices for limiting access
- Default to least privilege. Almost everyone needs only
Agentix.User. AddAgentix.AgentAdminfor a specific need rather than jumping straight toAgentix.AppAdmin. - Prefer
Agentix.AgentAdminoverAgentix.AppAdmin. Agent curation, the Monitor dashboard, and cross-cluster tokens all live at the agent-admin tier. ReserveAgentix.AppAdminfor the fleet-level and cluster-wide controls that genuinely need it. - Remember that Global skills and shared agents are cluster-wide. Promoting a skill or connection to Global, or editing a shared agent, affects everyone—keep those
Agentix.AppAdmin(Global) andAgentix.AgentAdmin(agent) grants to a trusted few. See Share a Skill Across Your Team. - Mind the service-account model for cross-cluster apps. Every cross-cluster call runs as the provisioned service account regardless of who triggered it, so scope those tokens to the minimum roles the agent needs. See Connect Apps from Other Clusters.
See also
- Quick Start: What every
Agentix.Usercan do. - Automations Overview: The asynchronous agent jobs every
Agentix.Usercan create and manage. - Create and Attach a Skill: Personal vs Global skills and who can promote them.
- Manage Agent Services: The fleet controls
Agentix.AppAdminunlocks. - Connect Apps from Other Clusters: What
Agentix.AgentAdminprovisions. - C3 AI Agentix Overview: How agents, chat, skills, and the admin surfaces fit together.