Permissions
============

Neo Code Agents have their own permission family, separate from Agentic Flow permissions. Access to flows and access to Neo Code Agents are granted independently, even though both appear side by side on **Home**.

Permissions are assigned to roles by a workspace administrator. See :doc:`/7_workspace_admin/index`.

Agent Permissions
------------------

.. list-table::
   :widths: 34 66
   :header-rows: 1

   * - Permission
     - Grants
   * - **View Remote Agent**
     - See Neo Code Agents and open them. Every other permission below depends on this one.
   * - **Create Remote Agent**
     - Add a new Neo Code Agent from the Create Agent page.
   * - **Edit Remote Agent**
     - Change an existing agent's settings, including its URL and deployment configuration.
   * - **Delete Remote Agent**
     - Remove an agent, subject to the deployment and edit-mode conditions described in :doc:`deployment`.
   * - **Deploy / Undeploy Remote Agent**
     - Trigger EKS deploys and undeploys.
   * - **Approve Remote Agent**
     - Act as reviewer in the publish flow — approve or reject a version.
   * - **Force Unlock**
     - Take back edit mode held by another user.

A further permission allows **Duplicate**, for copying an agent's configuration into a new one.

Tab Permissions
----------------

Each tab on a Neo Code Agent is gated separately, so a role can be given monitoring access without any ability to change the agent.

.. list-table::
   :widths: 30 70
   :header-rows: 1

   * - Permission group
     - Controls
   * - **Remote Agent Conversations**
     - The Conversations tab. A separate permission allows deleting a conversation.
   * - **Remote Agent Analytics**
     - The Analytics tab.
   * - **Remote Agent Traces**
     - The Traces tab. A separate permission allows adding a trace to a dataset.
   * - **Remote Agent API Access**
     - The API Access tab and its code samples.
   * - **Remote Agent Channels**
     - The Channels tab, with separate permissions for creating, editing, and toggling a channel.

Several of these work alongside platform-wide permissions: channels also require credentials permissions, conversations require session access, and traces require trace access. If a tab is missing for someone who holds the matching Neo Code Agent permission, check the underlying permission as well.

Sharing an Individual Agent
----------------------------

Role permissions decide whether someone can work with Neo Code Agents at all. **Share**, offered by the owner from the agent's header or its card menu, decides which specific agents they can reach. A user needs both: the role permission, and access to that particular agent.

Access to a Neo Code Agent is tracked separately from access to flows, so sharing a flow does not share a Neo Code Agent.

Example Role Splits
--------------------

.. list-table::
   :widths: 26 74
   :header-rows: 1

   * - Role
     - Typical grant
   * - **Agent developer**
     - View, Create, Edit, plus API Access and Traces — build and debug the integration.
   * - **Operator**
     - View, Deploy / Undeploy, plus Analytics and Conversations — keep it running without changing it.
   * - **Reviewer**
     - View and Approve — sign off versions before they go live.
   * - **Analyst**
     - View plus Analytics and Conversations — read the numbers, change nothing.