Permission sets

To decide who gets each permission set, see Give people access.

Permission set	API name	What it grants
Agent Kernel Admin	AgentKernelAdmin	Pluto Core configuration, operational visibility, run control, and scheduled payload retention without retained raw payload access. Assign to the user who owns the Core schedulers.
Agent Kernel Approval Relay	AgentKernelApprovalRelay	Lets an approval channel integration user deliver a decision made in another system on behalf of an eligible approver. Never assign to a person or to an execution user.
Agent Kernel Human Decision	AgentKernelHumanDecision	Additive authority to decide Agent Approvals assigned to the user or their queues and to reconcile Unknown outcomes. Includes read access to Agent Approval records; record visibility comes from ownership.
Agent Kernel Operator	AgentKernelOperator	Operational visibility and authority to start and control accessible Pluto Core runs without raw payload or credential access.
Agent Kernel Run Agents	AgentKernelRunAgents	Lets a person or integration start the agents shared with them and follow their own runs; answers show protected values as tokens. Share each Agent Definition to grant it. Add Agent Kernel Operator to pause, rescue, resume, or cancel runs.
Agent Kernel Sensitive Data	AgentKernelSensitiveData	Additive access to retained Pluto Core payload fields. Assign only with Agent Kernel Operator.
Agent Kernel Service Principal	AgentKernelServicePrincipal	Execution user access: reads active agent configuration and publishes lifecycle events. No access to run records; Core uses system mode. Never assign to a person or grant approval authority.
Agent Kernel Trust Resolver	AgentKernelTrustResolver	Allows authorized delivery services to resolve protected values in a run’s final output without vault access.
Pluto Admin	PlutoAdmin	Pluto console access. Pair with AgentKernelAdmin for Core configuration data.
Pluto Model Adapters	AgentModelAdapters	Lets agent runs call the OpenAI through the shipped Named Credentials. Assign it to execution users and to people who start agents without an Agent Execution Identity.