> For the complete documentation index, see [llms.txt](https://developer.kizen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.kizen.com/docs/concepts/agentic-workflows/agentic-workflow-permissions.md).

# Agentic Workflow Permissions

{% hint style="success" %}
**Audience:** Administrators, Developers, Solution Architects

**Purpose:** Understand how permissions control who can configure and manage Agentic Workflow, who can view execution history, and how Agentic Workflows behave at runtime regardless of user permissions.
{% endhint %}

## Overview

<code class="expression">space.vars.automation</code> permissions operate at multiple levels. One set controls who can access and configure an <code class="expression">space.vars.automation</code>. A separate set governs who can view execution history and intervene in running executions. A third governs what the <code class="expression">space.vars.automation</code> itself can do when it runs, and it is the level most critical to understand before deploying <code class="expression">space.vars.automations</code> in any multi-user environment.&#x20;

At runtime, an <code class="expression">space.vars.automation</code> does not run under the permissions of the user who configured it or the user who triggered it. It runs with elevated platform access that bypasses standard permission checks.

***

## How Agentic Workflow Permissions Work

Management access to <code class="expression">space.vars.automations</code> — including the ability to create, edit, and delete them — is controlled at the permission group level. Enabling the <code class="expression">space.vars.automations</code> toggle unlocks additional permission controls, each governing a different type of access.

To find all <code class="expression">space.vars.automation</code> Permissions, do the following steps.

{% stepper %}
{% step %}

#### In the top navigation bar, select Settings

<div data-with-frame="true"><figure><img src="/files/N6CUhdqAtT5QkLlJ0u3h" alt=""><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

#### Select Team, Roles, & Permissions

Select the **Permissions Groups** tab.

<div data-with-frame="true"><figure><img src="/files/tgSCYIZCEVX1Pc8D8DpH" alt="" width="563"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

#### Select New Permission Group

<div data-with-frame="true"><figure><img src="/files/qDpOeq5tIfdiC9vXEwww" alt="" width="563"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

The **Add Permission Group** modal will pop up. and you'll need to scroll down to find the <code class="expression">space.vars.automation</code> permissions, which you can toggle on. Each one is defined below for Agentic Worfklows, Single <code class="expression">space.vars.entity</code> Actions, Bulk Actions, and Scheduled <code class="expression">space.vars.automations</code>.&#x20;

<div data-with-frame="true"><figure><img src="/files/amxz6EnXcfD5CdpGTbod" alt="" width="375"><figcaption></figcaption></figure></div>

### Manage Agentic Worflow Permissions

**Manage Agentic Workflows** controls whether members of a permission group can create, edit, and delete <code class="expression">space.vars.automations</code>. This is the foundational permission for <code class="expression">space.vars.automation</code> configuration access. Members without this permission cannot open, modify, or delete any <code class="expression">space.vars.automation</code> in the workspace, regardless of what other <code class="expression">space.vars.automation</code> permissions they hold.

<div data-with-frame="true"><figure><img src="/files/zfsYgNFHrJzghEKX8Fwf" alt="" width="563"><figcaption></figcaption></figure></div>

### Single Record Actions

The **Modify Agentic Workflow** control under **Perform Single Record Actions** governs whether a user can manually interact with an <code class="expression">space.vars.automation</code> on an individual <code class="expression">space.vars.entity</code>; for example, starting, pausing, or canceling an execution from a v view. This is configured per <code class="expression">space.vars.object</code> (including <code class="expression">space.vars.contact</code>, as seen below).&#x20;

<div data-with-frame="true"><figure><img src="/files/HsnXOSAyDcCnRqPHHSXT" alt="" width="563"><figcaption></figcaption></figure></div>

### Bulk Actions

A separate **Modify Agentic Workflow** control under **Perform Bulk Actions** governs whether a user can apply <code class="expression">space.vars.automation</code> actions across multiple <code class="expression">space.vars.entities</code> at once. This is configured per <code class="expression">space.vars.object</code> (including <code class="expression">space.vars.contact</code>, as seen below).&#x20;

<div data-with-frame="true"><figure><img src="/files/TgzwktAZTDReWROimSkZ" alt="" width="563"><figcaption></figcaption></figure></div>

### Scheduled Agentic Workflows

Under **Broadcasts** in the Permissions settings, the **Scheduled Agentic Workflows** control governs access to scheduled <code class="expression">space.vars.automation</code> configurations. This control uses four permission levels —  **None**, **View,** **Create/Edit**, and **Delete/All** —  and is configured separately from the <code class="expression">space.vars.entity</code>-level action controls above.

<div data-with-frame="true"><figure><img src="/files/A7NP1h54d6HbtEPdJCi7" alt="" width="563"><figcaption></figcaption></figure></div>

***

## Execution Visibility

Execution visibility controls who can see the execution history and step-level detail for a running or completed <code class="expression">space.vars.automation</code>. Users with <code class="expression">space.vars.entity</code>-level access but without Manage <code class="expression">space.vars.automations</code> permission can see which <code class="expression">space.vars.automations</code> ran against a <code class="expression">space.vars.entity</code> and their status, but cannot open execution history or view step-level detail. Sensitive data processed during execution — such as <code class="expression">space.vars.contact</code> information, financial <code class="expression">space.vars.entities</code>, or communications — is only exposed to users who have been granted full execution visibility.

***

## Modify Agentic Workflows at the Record Level

Manually starting, pausing, or canceling an <code class="expression">space.vars.automation</code> execution on a <code class="expression">space.vars.entity</code> requires two conditions to be met simultaneously: the **Modify Agentic Workflows** permission and Edit access to the specific <code class="expression">space.vars.entity</code> the execution is running on. The permission controls whether a user can interact with <code class="expression">space.vars.automation</code> executions at all, while <code class="expression">space.vars.entity</code> Edit access determines whether they can act on a particular <code class="expression">space.vars.entity</code>. A user who has the permission but lacks Edit access to a <code class="expression">space.vars.entity</code> cannot intervene in executions on that <code class="expression">space.vars.entity</code>, and a user with Edit access but without the permission has no manual intervention controls available regardless of their <code class="expression">space.vars.entity</code> access.

***

## Runtime Permission Bypass

When an <code class="expression">space.vars.automation</code> executes, it does not run under the permissions of any user. The permissions of the user who configured it, the user who triggered it, and any other user do not apply at runtime. This is intentional behavior. <code class="expression">space.vars.automations</code> are designed to perform consistent, reliable operations regardless of who initiates them, so that execution outcomes do not vary based on the triggering user's permission level.

In practice, this means an <code class="expression">space.vars.automation</code> can read fields, update <code class="expression">space.vars.entities</code>, create <code class="expression">space.vars.entities</code>, and send communications that the triggering user might not be permitted to perform manually. A user with restricted permissions who triggers an <code class="expression">space.vars.automation</code> does not limit what that <code class="expression">space.vars.automation</code> does.

Administrators should treat <code class="expression">space.vars.automation</code> configuration as a governance responsibility. Recommended practices include:

* **Review before activating:** Confirm that each step accesses only the data it is intended to reach.
* **Limit who can create and activate:** In environments where sensitive data is involved — such as financial <code class="expression">space.vars.entities</code>, personal <code class="expression">space.vars.contact</code> information, or communications — restrict this to administrators or a designated team.
* **Review execution history periodically:** Verify that <code class="expression">space.vars.automations</code> are performing the actions you expect and not accessing data outside their intended scope.

***

## What's Next

Now that you understand how permissions govern access to <code class="expression">space.vars.automations</code> and executions, the next topic covers what happens during an <code class="expression">space.vars.automation</code>'s operational life. [Agentic Workflow Status & Lifecycle](/docs/concepts/agentic-workflows/agentic-workflow-status-and-lifecycle.md) covers the statuses an <code class="expression">space.vars.automation</code> and its executions move through, how those states transition, and how administrators can interpret the status indicators and error signals the platform provides.

<details>

<summary>Related Topics</summary>

* [Agentic Workflow Code Steps](/docs/concepts/agentic-workflows/automation-code-steps.md)
* [Agentic Workflow Execution & Process Model](/docs/concepts/agentic-workflows/agentic-workflow-execution-and-process-model.md)
* [Agentic Workflow Delays and Time-Based Behavior](/docs/concepts/agentic-workflows/agentic-workflow-delays-and-time-based-behavior.md)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.kizen.com/docs/concepts/agentic-workflows/agentic-workflow-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.