Agentic Data Plane

Roles and Permissions Reference

Every Redpanda Agentic Data Plane API call enforces a single permission. This reference lists the Agentic Data Plane-namespaced permissions and the operation each one gates.

Use this reference to:

  • Look up an Agentic Data Plane permission by namespace

  • Identify the operation each permission gates

  • Map a denied API call to the permission it enforces

These permission strings are the role-based access control (RBAC) vocabulary. They are not what you write to grant access.

Agentic Data Plane access is granted with access policies, which name their own actions, such as Action::"Agent.get". See Action reference for the list. Use this page to read what the Admin role covers, to map an API operation to the permission it enforces when you’re debugging a denial, or to define a custom role.

For how policies and roles fit together, see Control Who Can Do What.

How to read this reference

Each table column means the same thing across every namespace.

  • The Permission column is the exact string the API enforces.

  • The Operation column is the user-facing action this permission gates.

Among the built-in roles provisioned today, Admin is the only one that grants any of the permissions on this page, and it grants all of them, so there is no per-role column to read. Writer, Reader, and the task-specific built-in roles grant none of them. Older organizations can also still carry legacy Agentic Data Plane roles. See Built-in roles summary.

MCP server permissions

The dataplane_adp_mcpserver_* permissions gate both server management (CRUD) and the MCP protocol calls a client makes against a running server.

Permission Operation

dataplane_adp_mcpserver_create

Register a new MCP server

dataplane_adp_mcpserver_update

Modify an existing MCP server’s configuration

dataplane_adp_mcpserver_delete

Delete an MCP server

dataplane_adp_mcpserver_get

View one MCP server’s configuration

dataplane_adp_mcpserver_list

List MCP servers

dataplane_adp_mcpserver_initialize

Initialize an MCP session against a server

dataplane_adp_mcpserver_ping

Health-check an MCP server

dataplane_adp_mcpserver_resources_list

List resources a server exposes

dataplane_adp_mcpserver_resources_templates_list

List resource templates a server exposes

dataplane_adp_mcpserver_resources_read

Read a resource from a server

dataplane_adp_mcpserver_prompts_list

List prompts a server exposes

dataplane_adp_mcpserver_prompts_get

Retrieve a prompt from a server

dataplane_adp_mcpserver_tools_list

List tools a server exposes

dataplane_adp_mcpserver_tools_call

Invoke a tool on an MCP server

dataplane_adp_mcpserver_logging_set_level

Adjust an MCP server’s log level

A legacy dataplane_mcpserver_* namespace mirrors these permissions, and a legacy dataplane_aiagent_create, _get, _list, _update, and _delete set mirrors the agent management permissions. Both are scoped the same way: Admin grants the legacy and current namespaces, and no other built-in role grants either.

LLM provider permissions

The dataplane_adp_llmprovider_* permissions gate AI Gateway provider configuration and the runtime proxy that forwards LLM requests upstream.

Permission Operation

dataplane_adp_llmprovider_create

Create an LLM provider

dataplane_adp_llmprovider_get

View one LLM provider’s configuration

dataplane_adp_llmprovider_list

List LLM providers

dataplane_adp_llmprovider_update

Modify an LLM provider’s configuration

dataplane_adp_llmprovider_delete

Delete an LLM provider

dataplane_adp_llmprovider_invoke

Proxy LLM requests through AI Gateway at runtime

dataplane_adp_llmprovider_check_connection

Test an LLM provider connection, whether the provider is saved or still a draft on the create form

Testing a connection carries its own permission because the check accepts an unsaved provider as well as a saved one, so it is neither a read of an existing provider nor a create. A principal with read-only access can’t test a connection, and neither can one that holds only dataplane_adp_llmprovider_create. Of the built-in roles, only the Admin role grants it, and the Standard and Full access policy templates include it. For where the control appears, see Save and verify.

The dataplane_adp_llmprovider_invoke permission is all an application needs to send traffic through AI Gateway. It is the narrowest useful grant for a service account, and no built-in role provides it on its own. Grant it with an access policy naming Action::"LLMProvider.invoke".

Agent management permissions

The dataplane_adp_agent_* permissions gate declarative agent configuration.

Permission Operation

dataplane_adp_agent_create

Create a declarative agent

dataplane_adp_agent_get

View one agent’s configuration

dataplane_adp_agent_list

List agents

dataplane_adp_agent_update

Modify an agent’s configuration

dataplane_adp_agent_delete

Delete an agent

Agent credential permissions

The dataplane_adp_agent_credential_* permissions gate the OIDC client credentials an agent uses for outbound calls.

Permission Operation

dataplane_adp_agent_credential_create

Issue a new OIDC client credential for an agent

dataplane_adp_agent_credential_list

List an agent’s credentials

dataplane_adp_agent_credential_delete

Revoke an agent credential

Agent trigger permissions

The dataplane_adp_agent_trigger_* permissions gate triggers that start an agent in response to an external event, such as an incoming message or a schedule. See Trigger Agents.

Permission Operation

dataplane_adp_agent_trigger_create

Create a trigger on an agent

dataplane_adp_agent_trigger_get

View a trigger on an agent

dataplane_adp_agent_trigger_list

List triggers on agents

dataplane_adp_agent_trigger_update

Modify a trigger on an agent

dataplane_adp_agent_trigger_delete

Delete a trigger on an agent

dataplane_adp_agent_trigger_run_list

List the recorded runs of a trigger on an agent

A further dataplane_adp_agent_trigger_report_health permission lets internal trigger observers report trigger health. Admin grants it, and so do the Sandboxed and higher policy templates, but nothing tenant-facing needs it.

Agent session permissions

The dataplane_adp_agent_session_* permissions gate access to an agent’s conversation sessions: the persisted conversation threads a managed agent accumulates as it runs. Sessions exist for managed agents only; a self-managed agent keeps no session store. The runtime creates sessions, so there is no create permission, and the only thing dataplane_adp_agent_session_update allows is renaming one.

Permission Operation

dataplane_adp_agent_session_list

List an agent’s conversation sessions (summaries only)

dataplane_adp_agent_session_get

View one conversation session, including its full message transcript

dataplane_adp_agent_session_update

Rename one conversation session

dataplane_adp_agent_session_delete

Delete an agent’s conversation sessions

Granting dataplane_adp_agent_session_get exposes a session’s full conversation content (prompts, tool inputs and outputs, and model output), the same class of content that transcript access exposes. Treat it as sensitively as the transcript permissions when a policy grants it.

Agent network permissions

The dataplane_adp_agentnetwork_get permission gates the Agent Network view.

Permission Operation

dataplane_adp_agentnetwork_get

View the agent network topology and its metrics

Transcript permissions

The dataplane_adp_transcript_* permissions gate read access to agent conversation transcripts. Transcripts carry the full content of an agent’s conversations (system prompts, user messages, tool arguments, and model output). See See What Your Agent Did for what a transcript records.

Permission Operation

dataplane_adp_transcript_get

View a single agent conversation transcript

dataplane_adp_transcript_list

List agent conversation transcripts

Transcript access is separate from agent read access. A principal that can view an agent’s configuration through dataplane_adp_agent_get cannot read that agent’s transcripts. Grant transcript access deliberately, to the users and service accounts that need to read conversation content.

The built-in Read only template, and every template built on top of it, grants the transcript and session read permissions. To let a principal read resource configuration without reading conversations, write your own template or policy that omits the Transcript and Session actions rather than linking a built-in template.

Audit log permissions

The dataplane_adp_auditlog_* permissions gate read access to authorization events. Audit events can include user identities, resource names, network information, configuration changes, and captured request or response data. See Review the Audit Log for how to review them.

Permission Operation

dataplane_adp_auditlog_list

List audit log events and view an event’s details

The built-in Read only template grants dataplane_adp_auditlog_list, along with every template built on top of it. To let a principal read resource configuration without reading the audit log, write your own template or policy that omits AuditLog.list rather than linking a built-in template.

Telemetry ingestion permissions

The dataplane_adp_ingestfeedback_list permission gates reading the feedback Agentic Data Plane records when it rejects telemetry from a self-managed agent.

Permission Operation

dataplane_adp_ingestfeedback_list

List telemetry ingestion feedback: rejected spans and the reasons they were rejected

Access policy permissions

The dataplane_adp_policy_* and dataplane_adp_policytemplate_* permissions gate the access policies and policy templates themselves. See Manage Access Policies.

Permission Operation

dataplane_adp_policy_create

Create an access policy

dataplane_adp_policy_get

View one access policy

dataplane_adp_policy_list

List access policies

dataplane_adp_policy_update

Modify an access policy

dataplane_adp_policy_delete

Delete an access policy

dataplane_adp_policytemplate_create

Create a policy template

dataplane_adp_policytemplate_get

View one policy template

dataplane_adp_policytemplate_list

List policy templates

dataplane_adp_policytemplate_update

Modify a policy template

dataplane_adp_policytemplate_delete

Delete a policy template

dataplane_adp_systempolicy_list

List the policies derived from role bindings

dataplane_adp_effectivepolicyset_get

View the policy set in effect for a principal

dataplane_adp_effectivepolicyset_list

List effective policy sets

The permission to author access policies is itself an Agentic Data Plane permission, so Admin is the only built-in role that has it. Whoever manages access for your deployment needs Admin, or a policy that grants the Policy actions explicitly. Granting policy authoring is equivalent to granting everything a policy can grant.

The dataplane_adp_systempolicy_list permission is separate from dataplane_adp_policy_list because the derived view names the principal of every role binding in the organization.

Spending permissions

The dataplane_adp_spending_* permissions gate the governance APIs that surface AI spend, request counts, and token volume. See Set Up Budgets for what spending data Agentic Data Plane records automatically.

Permission Operation

dataplane_adp_spending_get

Read AI spending data for governance and cost reports

Budget permissions

The dataplane_adp_budget_* permissions gate per-agent LLM spend budgets. See Set a budget.

Permission Operation

dataplane_adp_budget_create

Create a budget

dataplane_adp_budget_get

View a budget and its current-period spend

dataplane_adp_budget_list

List budgets

dataplane_adp_budget_update

Modify a budget

dataplane_adp_budget_delete

Delete a budget

Guardrail permissions

The dataplane_adp_guardrail_* permissions gate guardrail policies that screen LLM requests and responses. See How Guardrails Work.

Permission Operation

dataplane_adp_guardrail_create

Create a guardrail policy

dataplane_adp_guardrail_get

View one guardrail policy’s configuration

dataplane_adp_guardrail_list

List guardrail policies

dataplane_adp_guardrail_update

Modify a guardrail policy

dataplane_adp_guardrail_delete

Delete a guardrail policy

A2A runtime permissions

dataplane_adp_a2a_invoke gates agent-to-agent (A2A) runtime traffic.

Permission Operation

dataplane_adp_a2a_invoke

Invoke an A2A agent: send or stream a message, read, list, cancel, or subscribe to a task, and read the extended agent card

One permission covers the whole A2A surface. Both the AI Gateway A2A proxy and the agent’s own endpoint authorize every A2A call, whether it sends a message, reads a task, or fetches the extended agent card, under dataplane_adp_a2a_invoke. A policy grants it by naming Action::"Agent.invoke".

Legacy per-method A2A permissions

The following per-method permissions are no longer evaluated. Holding one grants nothing, so don’t build a custom role on them. Grant A2A access with an access policy on Action::"Agent.invoke".

  • dataplane_aiagent_a2a_message_send

  • dataplane_aiagent_a2a_message_stream

  • dataplane_aiagent_a2a_tasks_get

  • dataplane_aiagent_a2a_tasks_list

  • dataplane_aiagent_a2a_tasks_cancel

  • dataplane_aiagent_a2a_tasks_subscribe

  • dataplane_aiagent_a2a_get_extended_agent_card

AI Gateway OAuth permissions

The dataplane_aigateway_* permissions gate the AI Gateway’s own OAuth surface: the inbound clients that request tokens from the gateway, dynamic client registration (DCR) and client ID metadata document (CIMD) settings, the outbound OAuth providers that MCP servers use for user-delegated authentication, and per-user OAuth connections in the token vault. Like every permission above, only Admin holds them among the built-in roles.

Permission Operation

dataplane_aigateway_oauthclient_create

Register an inbound OAuth client (external tool), including minting initial access tokens

dataplane_aigateway_oauthclient_get

View an inbound OAuth client’s details

dataplane_aigateway_oauthclient_list

List inbound OAuth clients and initial access tokens

dataplane_aigateway_oauthclient_update

Modify an inbound OAuth client registration

dataplane_aigateway_oauthclient_delete

Delete an inbound OAuth client, revoke its tokens, or revoke an initial access token

dataplane_aigateway_dcrsettings_get

View the tenant’s dynamic client registration settings

dataplane_aigateway_dcrsettings_update

Modify the tenant’s dynamic client registration settings

dataplane_aigateway_cimdsettings_get

View the tenant’s client ID metadata document settings

dataplane_aigateway_cimdsettings_update

Modify the tenant’s client ID metadata document settings

dataplane_aigateway_oauthprovider_create

Create an OAuth provider for MCP servers that use per-user OAuth tokens (includes running provider discovery)

dataplane_aigateway_oauthprovider_get

View an OAuth provider’s configuration

dataplane_aigateway_oauthprovider_list

List OAuth providers

dataplane_aigateway_oauthprovider_update

Modify an OAuth provider’s configuration

dataplane_aigateway_oauthprovider_delete

Delete an OAuth provider

dataplane_aigateway_oauthprovider_attach

Attach an OAuth provider to an MCP server so the server can consume per-user OAuth tokens from it

dataplane_aigateway_connection_manage

Manage your own OAuth connections to third-party providers (authorize, list, get, revoke)

dataplane_aigateway_connection_admin

Administer OAuth connections across all users and rotate the token vault encryption key

Built-in roles summary

Role Coverage of the permissions on this page

Admin

Every Agentic Data Plane permission on this page. Bind it to the operators who administer the deployment.

Writer

No Agentic Data Plane permissions.

Reader

No Agentic Data Plane permissions.

Redpanda no longer provisions Agentic Data Plane-specific built-in roles for runtime invocation or transcript reads, and isn’t adding more. Grant that access with an access policy.

Organizations created before that change can still have the legacy AIAgentInvoker, MCPInvoker, LLMProviderInvoker, and TranscriptReader roles, which keep the Agentic Data Plane permissions they were last given. Check your role bindings for them if you expect Admin to be the only role that grants these permissions.

A custom role holding permissions from this page still works. Use one when you need a bundle bound at a control-plane scope.

Next steps