Permissions

Neo Code Agents have their own permission family, separate from Agentic Flow permissions. Access to flows and access to Neo Code Agents are granted independently, even though both appear side by side on Home.

Permissions are assigned to roles by a workspace administrator. See Workspace Administration.

Agent Permissions

Permission	Grants
View Remote Agent	See Neo Code Agents and open them. Every other permission below depends on this one.
Create Remote Agent	Add a new Neo Code Agent from the Create Agent page.
Edit Remote Agent	Change an existing agent’s settings, including its URL and deployment configuration.
Delete Remote Agent	Remove an agent, subject to the deployment and edit-mode conditions described in EKS Deployment.
Deploy / Undeploy Remote Agent	Trigger EKS deploys and undeploys.
Approve Remote Agent	Act as reviewer in the publish flow — approve or reject a version.
Force Unlock	Take back edit mode held by another user.

A further permission allows Duplicate, for copying an agent’s configuration into a new one.

Tab Permissions

Each tab on a Neo Code Agent is gated separately, so a role can be given monitoring access without any ability to change the agent.

Permission group	Controls
Remote Agent Conversations	The Conversations tab. A separate permission allows deleting a conversation.
Remote Agent Analytics	The Analytics tab.
Remote Agent Traces	The Traces tab. A separate permission allows adding a trace to a dataset.
Remote Agent API Access	The API Access tab and its code samples.
Remote Agent Channels	The Channels tab, with separate permissions for creating, editing, and toggling a channel.

Several of these work alongside platform-wide permissions: channels also require credentials permissions, conversations require session access, and traces require trace access. If a tab is missing for someone who holds the matching Neo Code Agent permission, check the underlying permission as well.

Sharing an Individual Agent

Role permissions decide whether someone can work with Neo Code Agents at all. Share, offered by the owner from the agent’s header or its card menu, decides which specific agents they can reach. A user needs both: the role permission, and access to that particular agent.

Access to a Neo Code Agent is tracked separately from access to flows, so sharing a flow does not share a Neo Code Agent.

Example Role Splits

Role	Typical grant
Agent developer	View, Create, Edit, plus API Access and Traces — build and debug the integration.
Operator	View, Deploy / Undeploy, plus Analytics and Conversations — keep it running without changing it.
Reviewer	View and Approve — sign off versions before they go live.
Analyst	View plus Analytics and Conversations — read the numbers, change nothing.