Dialogflow 主控台會將代理程式管理員角色提供給建立代理程式的使用者。這個使用者會自動獲得與代理程式相關聯專案中的 IAM 專案擁有者角色。
代理程式管理員可以在 Dialogflow 主控台中為代理程式新增開發人員和審查人員。在 Dialogflow 控制台中授予開發人員或審查員角色時，使用者會分別獲得 IAM 專案編輯者角色或 IAM 專案檢視者角色。如要將開發人員和審查人員新增至代理人，另一種方法是在 Google Cloud 主控台中授予使用者對應的 IAM 專案編輯者或 IAM 專案檢視者角色。
在某些狀況下，您必須使用 Google Cloud 主控台：
如果您想要變更代理程式的管理員、為單一代理程式新增多位管理員，或為某個代理程式移除管理員，就需要使用 Google Cloud 主控台。
如果您已整合其他 Google Cloud 資源 (例如 Cloud Functions)，但不想向應用程式授予整個專案的存取權，則必須在 IAM 主控台指派管理員、用戶端或讀取者等 Dialogflow API 角色。 Google Cloud
部分身分與存取權管理角色具有對應的 Dialogflow 主控台角色。如果想要授予 Dialogflow 主控台中沒有的角色，則需要使用 Google Cloud 主控台。
角色
下表列出與 Dialogflow 相關的常見角色、Dialogflow 主控台角色與 IAM 角色之間的關聯，以及權限的詳細資料。
您可以將角色授予使用者或服務帳戶，藉此為 Google Cloud 專案提供權限。只要提供使用者的電子郵件地址即可新增使用者，服務帳戶也是透過提供相關聯的電子郵件地址來進行新增。如果您想在多個專案和代理程式上使用單一服務帳戶，則需要新增服務帳戶成員。如需取得與服務帳戶相關聯的電子郵件地址，請參閱 Google Cloud 控制台中的「IAM」「Service Accounts」頁面。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eRoles are used to control access and permissions for team members and services interacting with an agent, with principals and service accounts being the main entities managed.\u003c/p\u003e\n"],["\u003cp\u003eAccess to Dialogflow agents can be managed through either Identity and Access Management (IAM) in the Google Cloud console or directly within the Dialogflow Console, each offering different levels of granularity.\u003c/p\u003e\n"],["\u003cp\u003eThe Dialogflow Console roles (Admin, Developer, Reviewer) correspond to specific IAM roles (Project Owner, Editor, Viewer), granting varying levels of access from full control to read-only permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud console is necessary for tasks like changing or adding multiple admins, integrating with other Google Cloud resources without full project access, and assigning roles not available in the Dialogflow Console.\u003c/p\u003e\n"],["\u003cp\u003eUsing the detectIntent API method during a conversation requires a role that provides full access, edit access, or session access, enabling the method to perform a write on the session state.\u003c/p\u003e\n"]]],[],null,["# Access control\n\nIt is common for multiple team members to collaborate on building an agent\nand for services to access the agent.\nUsing *roles* , you can control access and permissions granted to\n[principals](/docs/authentication#principal).\n| **Note:** Developers should avoid working on the same agent at the same time. This can cause conflicts when saving and training the agent.\n\nIf you are using the API,\nyou may also have one or more applications that send requests to an agent.\nIn this case, you can control access with\n[service accounts](/dialogflow/docs/quick/setup#auth).\n\nYou can control access using either\n[Identity and Access Management (IAM)](/iam/docs)\nor the [Dialogflow Console](/dialogflow/docs/console).\n\nThe Dialogflow Console provides the Agent Admin role to the user that created\nthe agent. This user automatically gets the IAM Project Owner\nrole in the project associated with the agent.\n\nAgent Admins can add Developers and Reviewers to the agent in the Dialogflow\nConsole. When the Developer or Reviewer role is granted in the Dialogflow\nConsole, the user gets the IAM Project Editor role or\nIAM Project Viewer role respectively. An alternative way to add\nDevelopers and Reviewers to the agent is to grant users the corresponding\nIAM Project Editor or IAM Project Viewer roles in\nthe Google Cloud console.\n\nThere are some situations in which you must use the Google Cloud console:\n\n- If you want to change the Admin, add multiple Admins for one agent, or remove Admins for an agent, you need to use the Google Cloud console.\n- If you have integrations with other Google Cloud resources, like Cloud Functions, and you don't want to grant full project access to an application, you must assign the Dialogflow API roles (Admin, Client, or Reader) in the Google Cloud console for IAM.\n- A subset of IAM roles have corresponding Dialogflow Console roles. If you want to grant a role that does not exist on the Dialogflow Console, you need to use the Google Cloud console.\n\nRoles\n-----\n\nThe following table lists common roles relevant to Dialogflow, the correlation\nbetween the Dialogflow Console roles and the IAM roles, and\ndetails about permissions.\n\nPermission summaries in the table use the following terms:\n\n- **Full access**: Permission to modify access, create, delete, edit, and read any resource.\n- **Edit access**: Permission to create, delete, edit, and read any resource.\n- **Session access**: Permission to call methods for runtime-only resources during a conversation like detecting intent, updating context, updating session entities, or Agent Assist conversation interactions. This access provides a subset of permissions found in full and edit access.\n- **Read access**: Permission to read any resource.\n\n| **Note:** In order to modify access for an agent, you need a role that provides **full access** to the agent. In order to delete an agent with the console, you need a role that provides **full access** to the agent. In order to delete an agent with the API, you need a role that provides **full access** or **edit access** to the agent.\n| **Note:** The [console simulator](/dialogflow/es/docs/console#simulator) calls the detectIntent API method during a conversation. This method performs a write on the session state. In order to use the console or call the API's detectIntent/streamingDetectIntent methods, you need a role that provides **full access** , **edit access** , or **session access**.\n\nControl access with the Google Cloud console\n--------------------------------------------\n\nYou can control access with [IAM](/iam/docs) settings.\nSee the [IAM quickstart](/iam/docs/grant-role-console)\nfor detailed instructions on adding, editing, and removing permissions.\n\nTo access the settings below, open the\n[IAM](https://console.cloud.google.com/iam-admin/iam) page in the Google Cloud console.\n\n### Add a user or service account to the project\n\nYou can provide permissions to either users or service accounts\nby granting them roles on your Google Cloud project.\nUsers are added by providing their email address.\nService accounts are also added by providing their associated email address.\nYou need to add service account members when you want to use one service account for multiple projects and agents.\nTo find the email address associated with your service account, see the IAM\n[Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts) page in the Google Cloud console.\n\nTo add a member:\n\n1. Click the add add button at the top of the page.\n2. Enter the member's email address.\n3. Select a role.\n4. Click **Save**.\n\n### Change permissions\n\n1. Click the edit edit button for the member.\n2. Select a different role.\n3. Click **Save**.\n\n### Remove a member\n\n1. Click the delete delete button for the member.\n\nControl access with the Dialogflow Console\n------------------------------------------\n\nSharing options are found in the agent's settings.\nTo open the agent sharing settings:\n\n1. Go to the [Dialogflow ES console](https://dialogflow.cloud.google.com).\n2. Select your agent near the top of the left sidebar menu.\n3. Click the settings settings button next to the agent name.\n4. Click the **Share** tab. If you do not see the **Share** tab, it is because you do not have the required Agent Admin role.\n\n### Add a user\n\n1. Enter the user's email address under **Invite New People**.\n2. Select a role.\n3. Click **Add**.\n4. Click **Save**.\n\n### Change permissions\n\n1. Find the user in the list.\n2. Select a different role.\n3. Click **Save**.\n\n### Remove a user\n\n1. Find the user in the list.\n\n | **Note:** If a user is listed with a prefix of `deleted:user:`, this user has been removed from your organization. The Dialogflow console cannot remove this user. You must [use the Cloud Console](#gcp-console) to remove this user.\n2. Click the delete clear button for the user.\n\n3. Click **Save**.\n\n| **Note:** After you grant or change permissions, there may be a delay before the changes take effect.\n\nAutomatically created service accounts\n--------------------------------------\n\nWhen you create and work with your agent,\nDialogflow creates some [service agents](/iam/docs/service-account-types#service-agents)\nautomatically.\n\nTo see the roles granted to these service agents, enable the **Include Google-provided role grants**\noption on the\n[IAM page](https://console.cloud.google.com/iam-admin/iam).\n\nYou should not delete, edit, or download keys for any of these service agents,\nnor should you use these service agents to make direct API calls.\nThey are used only by the Dialogflow service to connect to a variety\nof Google Cloud services used by your agent.\nYou may need to refer to these service agents by email when\nconfiguring certain Dialogflow features.\n\nThe following table describes some of these service agents:\n\nTransfer admin role\n-------------------\n\nIn order to transfer the admin role of an agent,\nthe existing admin needs to [follow steps](#gcp-add) above to add a new admin.\nOnce the new admin accepts the granted role,\nit is safe to remove the old admin.\n\nIf the existing admin no longer works at your organization,\nand you need the admin role transferred to another employee,\nyou have two options:\n\n- An administrator of the [organization](/resource-manager/docs/cloud-platform-resource-hierarchy) associated with the agent's project has permissions to modify the agent admin.\n- If you have read permissions for the agent, you can export the agent and import to an agent where the desired employee is admin. This may create downtime for a live production agent while the agent is migrated and any integrations are updated.\n\nOAuth\n-----\n\nIf you are using Google client libraries to access Dialogflow,\nyou do not need to use\n[OAuth](https://developers.google.com/identity/protocols/oauth2)\ndirectly, because these libraries handle the implementation for you.\nHowever, if you are implementing your own client,\nyou may need to implement your own OAuth flow.\nAccess to the Dialogflow API requires one of the following OAuth scopes:\n\n- `https://www.googleapis.com/auth/cloud-platform` (access to all project resources)\n- `https://www.googleapis.com/auth/dialogflow` (access to Dialogflow resources)\n\nRequests that involve Cloud Storage access\n------------------------------------------\n\nSome Dialogflow requests access objects in\n[Cloud Storage](/storage/docs)\nfor reading or writing data.\nWhen you call one of these requests,\nDialogflow accesses the Cloud Storage data on the caller's behalf.\nThis means that your request authentication must have permissions\nto access Dialogflow as well as the Cloud Storage objects.\n\nWhen using a Google client library and IAM roles,\nsee the\n[Cloud Storage access control guide](/storage/docs/access-control)\nfor information on Cloud Storage roles.\n\nWhen implementing your own client and using [OAuth](#oauth),\nyou must use the following OAuth scope:\n\n- `https://www.googleapis.com/auth/cloud-platform` (access to all project resources)"]]
