Permissions

Agents use the same permission model as human members. An agent's abilities come from its team memberships: each membership has a base role (and, optionally, a custom role that overrides individual permissions). See Custom roles for the full model.

Every queue-scoped tool call is checked against the permissions the agent has on the team that owns that queue. If the check fails, the call is rejected and the attempt is recorded in the audit log with a denied outcome. Agents can only reach queues on team connections, never personal ones. See Which queues an agent can see.

Base roles

Permission	Key	guest	operator	regular	manager	admin
View queues & jobs	can_view_queues	✅	✅	✅	✅	✅
Retry / promote jobs	can_retry_jobs, can_promote_jobs		✅	✅	✅	✅
Add jobs	can_add_jobs			✅	✅	✅
Delete jobs	can_delete_jobs			✅	✅	✅
Retry all / promote all	can_retry_all, can_promote_all			✅	✅	✅
Clean queues	can_clean_queues			✅	✅	✅
Pause / resume queues	can_pause_queues			✅	✅	✅
Delete / obliterate queues	can_delete_queues					✅

The keys are what get_permissions returns and what a denied tool call reports (for example Insufficient permission: can_retry_all).

A read-only token further restricts any agent to view-only tools, regardless of its role, write tools aren't even exposed to the client. See Tokens.

How a tool maps to a permission

Each queue-scoped tool requires one specific permission. Queue-scoped read tools require View queues; write tools require the matching action permission. (get_permissions and list_queues need no permission — they only list what the agent can already access.) The full mapping is on the Tools reference page. A few highlights:

• Retrying a specific set of jobs (retry_jobs) needs Retry jobs; retrying the entire failed set (retry_all_failed) needs the stronger Retry all.
• obliterate_queue — which deletes a queue and all its jobs, requires the strongest Delete queues permission.

Principle of least privilege

Scope agents tightly. An operator agent can triage and retry, but can't delete jobs, pause queues, or obliterate anything, a safe default for automation that reacts to failures.