Agentic Data Plane

Roles and Permissions Reference

Every Redpanda Agentic Data Plane API call enforces a single permission. This reference lists the Agentic Data Plane-namespaced permissions and the operation each one gates.

Use this reference to:

  • Look up an Agentic Data Plane permission by namespace

  • Identify the operation each permission gates

  • Map a denied API call to the permission it enforces

These permission strings are the role-based access control (RBAC) vocabulary. They are not what you write to grant access.

Agentic Data Plane access is granted with access policies, which name their own actions, such as Action::"Agent.get". See Action reference for the list. Use this page to read what the Admin role covers, to map an API operation to the permission it enforces when you’re debugging a denial, or to define a custom role.

For how policies and roles fit together, see Control Who Can Do What.

How to read this reference

Each table column means the same thing across every namespace.

  • The Permission column is the exact string the API enforces.

  • The Operation column is the user-facing action this permission gates.

Admin is the only built-in role that grants any of the permissions on this page, and it grants all of them, so there is no per-role column to read. Writer, Reader, and the task-specific built-in roles grant none of them.

Two Redpanda Connect namespaces behave differently. Pipeline and knowledge base permissions are owned outside Agentic Data Plane, so they remain part of Writer and Reader and keep their role columns.

MCP server permissions

The dataplane_adp_mcpserver_* permissions gate both server management (CRUD) and the MCP protocol calls a client makes against a running server.

Permission Operation

dataplane_adp_mcpserver_create

Register a new MCP server

dataplane_adp_mcpserver_update

Modify an existing MCP server’s configuration

dataplane_adp_mcpserver_delete

Delete an MCP server

dataplane_adp_mcpserver_get

View one MCP server’s configuration

dataplane_adp_mcpserver_list

List MCP servers

dataplane_adp_mcpserver_initialize

Initialize an MCP session against a server

dataplane_adp_mcpserver_ping

Health-check an MCP server

dataplane_adp_mcpserver_resources_list

List resources a server exposes

dataplane_adp_mcpserver_resources_templates_list

List resource templates a server exposes

dataplane_adp_mcpserver_resources_read

Read a resource from a server

dataplane_adp_mcpserver_prompts_list

List prompts a server exposes

dataplane_adp_mcpserver_prompts_get

Retrieve a prompt from a server

dataplane_adp_mcpserver_tools_list

List tools a server exposes

dataplane_adp_mcpserver_tools_call

Invoke a tool on an MCP server

dataplane_adp_mcpserver_logging_set_level

Adjust an MCP server’s log level

A legacy dataplane_mcpserver_* namespace mirrors these permissions and is still enforced by older proto versions. It is scoped the same way: Admin grants both namespaces, and no other built-in role grants either.

LLM provider permissions

The dataplane_adp_llmprovider_* permissions gate AI Gateway provider configuration and the runtime proxy that forwards LLM requests upstream.

Permission Operation

dataplane_adp_llmprovider_create

Create an LLM provider

dataplane_adp_llmprovider_get

View one LLM provider’s configuration

dataplane_adp_llmprovider_list

List LLM providers

dataplane_adp_llmprovider_update

Modify an LLM provider’s configuration

dataplane_adp_llmprovider_delete

Delete an LLM provider

dataplane_adp_llmprovider_invoke

Proxy LLM requests through AI Gateway at runtime

The dataplane_adp_llmprovider_invoke permission is all an application needs to send traffic through AI Gateway. It is the narrowest useful grant for a service account, and no built-in role provides it on its own. Grant it with an access policy naming Action::"LLMProvider.invoke".

Agent management permissions

The dataplane_adp_agent_* permissions gate declarative agent configuration.

Permission Operation

dataplane_adp_agent_create

Create a declarative agent

dataplane_adp_agent_get

View one agent’s configuration

dataplane_adp_agent_list

List agents

dataplane_adp_agent_update

Modify an agent’s configuration

dataplane_adp_agent_delete

Delete an agent

Agent credential permissions

The dataplane_adp_agent_credential_* permissions gate the OIDC client credentials an agent uses for outbound calls.

Permission Operation

dataplane_adp_agent_credential_create

Issue a new OIDC client credential for an agent

dataplane_adp_agent_credential_list

List an agent’s credentials

dataplane_adp_agent_credential_delete

Revoke an agent credential

Agent trigger permissions

The dataplane_adp_agent_trigger_* permissions gate triggers that start an agent in response to an external event, such as an incoming message or a schedule. See Trigger Agents.

Permission Operation

dataplane_adp_agent_trigger_create

Create a trigger on an agent

dataplane_adp_agent_trigger_get

View a trigger on an agent

dataplane_adp_agent_trigger_list

List triggers on agents

dataplane_adp_agent_trigger_update

Modify a trigger on an agent

dataplane_adp_agent_trigger_delete

Delete a trigger on an agent

A further dataplane_adp_agent_trigger_report_health permission lets internal trigger observers report trigger health. Only Admin grants it, and nothing tenant-facing needs it.

Agent session permissions

The dataplane_adp_agent_session_* permissions gate access to an agent’s conversation sessions: the persisted conversation threads a managed agent accumulates as it runs. Sessions exist for managed agents only; a self-managed agent keeps no session store. The runtime creates sessions, so there is no create or update permission.

Permission Operation

dataplane_adp_agent_session_list

List an agent’s conversation sessions (summaries only)

dataplane_adp_agent_session_get

View one conversation session, including its full message transcript

dataplane_adp_agent_session_delete

Delete an agent’s conversation sessions

Granting dataplane_adp_agent_session_get exposes a session’s full conversation content (prompts, tool inputs and outputs, and model output), the same class of content that transcript access exposes. Treat it as sensitively as the transcript permissions when a policy grants it.

Transcript permissions

The dataplane_adp_transcript_* permissions gate read access to agent conversation transcripts. Transcripts carry the full content of an agent’s conversations (system prompts, user messages, tool arguments, and model output). See See What Your Agent Did for what a transcript records.

Permission Operation

dataplane_adp_transcript_get

View a single agent conversation transcript

dataplane_adp_transcript_list

List agent conversation transcripts

Transcript access is separate from agent read access. A principal that can view an agent’s configuration through dataplane_adp_agent_get cannot read that agent’s transcripts. Grant transcript access deliberately, with a policy naming the Transcript actions, to the users and service accounts that need to read conversation content.

Audit log permissions

The dataplane_adp_auditlog_* permissions gate read access to authorization events. Audit events can include user identities, resource names, network information, configuration changes, and captured request or response data. See Review the Audit Log for how to review them.

Permission Operation

dataplane_adp_auditlog_list

List audit log events and view an event’s details

The built-in Read only template grants dataplane_adp_auditlog_list, along with every template built on top of it. To let a principal read resource configuration without reading the audit log, write your own template or policy that omits AuditLog.list rather than linking a built-in template.

Access policy permissions

The dataplane_adp_policy_* and dataplane_adp_policytemplate_* permissions gate the access policies and policy templates themselves. See Manage Access Policies.

Permission Operation

dataplane_adp_policy_create

Create an access policy

dataplane_adp_policy_get

View one access policy

dataplane_adp_policy_list

List access policies

dataplane_adp_policy_update

Modify an access policy

dataplane_adp_policy_delete

Delete an access policy

dataplane_adp_policytemplate_create

Create a policy template

dataplane_adp_policytemplate_get

View one policy template

dataplane_adp_policytemplate_list

List policy templates

dataplane_adp_policytemplate_update

Modify a policy template

dataplane_adp_policytemplate_delete

Delete a policy template

dataplane_adp_systempolicy_list

List the policies derived from role bindings

dataplane_adp_effectivepolicyset_get

View the policy set in effect for a principal

dataplane_adp_effectivepolicyset_list

List effective policy sets

The permission to author access policies is itself an Agentic Data Plane permission, so Admin is the only built-in role that has it. Whoever manages access for your deployment needs Admin, or a policy that grants the Policy actions explicitly. Granting policy authoring is equivalent to granting everything a policy can grant.

The dataplane_adp_systempolicy_list permission is separate from dataplane_adp_policy_list because the derived view names the principal of every role binding in the organization.

Spending permissions

The dataplane_adp_spending_* permissions gate the governance APIs that surface AI spend, request counts, and token volume. See Set Up Budgets for what spending data Agentic Data Plane records automatically.

Permission Operation

dataplane_adp_spending_get

Read AI spending data for governance and cost reports

Budget permissions

The dataplane_adp_budget_* permissions gate per-agent LLM spend budgets. See Set a budget.

Permission Operation

dataplane_adp_budget_create

Create a budget

dataplane_adp_budget_get

View a budget and its current-period spend

dataplane_adp_budget_list

List budgets

dataplane_adp_budget_update

Modify a budget

dataplane_adp_budget_delete

Delete a budget

Guardrail permissions

The dataplane_adp_guardrail_* permissions gate guardrail policies that screen LLM requests and responses. See How Guardrails Work.

Permission Operation

dataplane_adp_guardrail_create

Create a guardrail policy

dataplane_adp_guardrail_get

View one guardrail policy’s configuration

dataplane_adp_guardrail_list

List guardrail policies

dataplane_adp_guardrail_update

Modify a guardrail policy

dataplane_adp_guardrail_delete

Delete a guardrail policy

A2A runtime permissions

The dataplane_aiagent_a2a_* permissions, along with dataplane_adp_a2a_invoke, gate agent-to-agent (A2A) runtime traffic.

Permission Operation

dataplane_adp_a2a_invoke

Invoke an A2A agent

dataplane_aiagent_a2a_message_send

Send a message to an agent

dataplane_aiagent_a2a_message_stream

Open a streaming message connection to an agent

dataplane_aiagent_a2a_tasks_get

Read one A2A task

dataplane_aiagent_a2a_tasks_list

List A2A tasks

dataplane_aiagent_a2a_tasks_cancel

Cancel an A2A task

dataplane_aiagent_a2a_tasks_subscribe

Subscribe to A2A task events

dataplane_aiagent_a2a_get_extended_agent_card

Read an agent’s extended agent card

The dataplane_adp_a2a_invoke permission covers the AI Gateway A2A proxy path, and a policy can grant it by naming Action::"Agent.invoke".

The dataplane_aiagent_a2a_* permissions are different. The agent’s own ingress enforces them against the caller’s RBAC permission set, and they have no access-policy action, so a policy can’t grant them. A service account that talks to an agent’s A2A endpoint directly needs Admin or a custom role holding this set.

Pipeline permissions

The dataplane_pipeline_* permissions gate Redpanda Connect pipelines used by Agentic Data Plane for ingestion and transformation. These are Redpanda Connect permissions rather than Agentic Data Plane permissions, so the Writer, Reader, and PipelineInvoker built-in roles grant them as shown. The PipelineInvoker role grants only the runtime invocation permissions.

Permission Operation Writer Reader Invoker

dataplane_pipeline_create

Create a pipeline

✓

dataplane_pipeline_get

View one pipeline’s configuration

✓

✓

dataplane_pipeline_list

List pipelines

✓

✓

dataplane_pipeline_update

Modify a pipeline’s configuration

✓

dataplane_pipeline_delete

Delete a pipeline

✓

dataplane_pipeline_start

Start a stopped pipeline

✓

dataplane_pipeline_stop

Stop a running pipeline

✓

dataplane_pipeline_gateway_invoke

Invoke a pipeline through the gateway endpoint

✓

PipelineInvoker

dataplane_pipeline_otlp_grpc_invoke

Send OTLP traces to a pipeline over gRPC

✓

PipelineInvoker

dataplane_pipeline_otlp_http_invoke

Send OTLP traces to a pipeline over HTTP

✓

PipelineInvoker

Access policies can’t govern pipelines. The entity types a policy can name are listed in Action reference, and pipelines aren’t among them.

Knowledge base permissions

The dataplane_knowledgebase_* permissions gate retrieval-augmented generation (RAG) knowledge bases. Like the pipeline permissions, these are Redpanda Connect permissions and remain part of Writer and Reader.

Permission Operation Writer Reader

dataplane_knowledgebase_create

Create a knowledge base

✓

dataplane_knowledgebase_get

View one knowledge base’s configuration

✓

✓

dataplane_knowledgebase_list

List knowledge bases

✓

✓

dataplane_knowledgebase_update

Modify a knowledge base’s configuration

✓

dataplane_knowledgebase_delete

Delete a knowledge base

✓

Built-in roles summary

Role Coverage of the permissions on this page

Admin

Every Agentic Data Plane permission on this page, plus the pipeline and knowledge-base permissions. Bind it to the operators who administer the deployment.

Writer

No Agentic Data Plane permissions. Grants full management of pipelines and knowledge bases, alongside its control-plane and Kafka permissions.

Reader

No Agentic Data Plane permissions. Grants _get and _list on pipelines and knowledge bases, alongside its control-plane and Kafka permissions.

PipelineInvoker

No Agentic Data Plane permissions. Grants the three pipeline runtime invocation permissions.

Redpanda no longer provisions Agentic Data Plane-specific built-in roles for runtime invocation or transcript reads, and isn’t adding more. Grant that access with an access policy.

A custom role holding permissions from this page still works. Reach for one when you need a bundle bound at a control-plane scope, or for the dataplane_aiagent_a2a_* permissions, which no policy action covers.

Next steps