Customer Engagement Suite with Google AI roles and permissions

This page lists the IAM roles and permissions for Customer Engagement Suite with Google AI. To search through all roles and permissions, see the role and permission index.

Customer Engagement Suite with Google AI roles

Role	Permissions
Customer Engagement Suite Admin ^Beta (roles/ces.admin) Full access to Customer Engagement Suite resources.	ces.* ces.agents.create ces.agents.delete ces.agents.get ces.agents.list ces.agents.update ces.appVersions.create ces.appVersions.delete ces.appVersions.get ces.appVersions.list ces.appVersions.restore ces.apps.create ces.apps.delete ces.apps.export ces.apps.get ces.apps.import ces.apps.list ces.apps.update ces.changelogs.get ces.changelogs.list ces.conversations.delete ces.conversations.get ces.conversations.list ces.deployments.create ces.deployments.delete ces.deployments.get ces.deployments.list ces.deployments.update ces.evaluationDatasets.create ces.evaluationDatasets.delete ces.evaluationDatasets.get ces.evaluationDatasets.list ces.evaluationDatasets.update ces.evaluationResults.delete ces.evaluationResults.get ces.evaluationResults.list ces.evaluationRuns.delete ces.evaluationRuns.get ces.evaluationRuns.list ces.evaluations.create ces.evaluations.delete ces.evaluations.get ces.evaluations.list ces.evaluations.update ces.examples.create ces.examples.delete ces.examples.get ces.examples.list ces.examples.update ces.guardrails.create ces.guardrails.delete ces.guardrails.get ces.guardrails.list ces.guardrails.update ces.locations.get ces.locations.list ces.operations.cancel ces.operations.delete ces.operations.get ces.operations.list ces.sessions.bidiRunSession ces.sessions.runSession ces.tools.create ces.tools.delete ces.tools.execute ces.tools.get ces.tools.list ces.tools.update ces.toolsets.create ces.toolsets.delete ces.toolsets.get ces.toolsets.list ces.toolsets.update resourcemanager.projects.get resourcemanager.projects.list
Customer Engagement Suite Client ^Beta (roles/ces.client) Query access to Customer Engagement Suite agents.	ces.sessions.* ces.sessions.bidiRunSession ces.sessions.runSession ces.tools.execute
Customer Engagement Suite Service Agent (roles/ces.serviceAgent) Allows Customer Engagement Suite Service Account to access to dependent resources. Warning: Do not grant service agent roles to any principals except service agents.	aiplatform.endpoints.get aiplatform.endpoints.predict aiplatform.extensions.execute aiplatform.extensions.get aiplatform.models.get aiplatform.ragCorpora.* aiplatform.ragCorpora.create aiplatform.ragCorpora.delete aiplatform.ragCorpora.get aiplatform.ragCorpora.list aiplatform.ragCorpora.query aiplatform.ragCorpora.update aiplatform.ragFiles.* aiplatform.ragFiles.delete aiplatform.ragFiles.get aiplatform.ragFiles.import aiplatform.ragFiles.list aiplatform.ragFiles.upload bigquery.datasets.create bigquery.datasets.get bigquery.datasets.updateTag bigquery.jobs.create bigquery.tables.create bigquery.tables.get bigquery.tables.getData bigquery.tables.update bigquery.tables.updateData ces.sessions.* ces.sessions.bidiRunSession ces.sessions.runSession ces.tools.execute cloudfunctions.functions.invoke connectors.actions.* connectors.actions.execute connectors.actions.list connectors.connections.executeSqlQuery connectors.connections.generateOpenAPISpec connectors.connections.get connectors.entities.* connectors.entities.create connectors.entities.delete connectors.entities.deleteEntitiesWithConditions connectors.entities.get connectors.entities.list connectors.entities.update connectors.entities.updateEntitiesWithConditions connectors.entityTypes.list connectors.operations.get connectors.versions.get discoveryengine.collections.list discoveryengine.dataStores.create discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.documents.create discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.update discoveryengine.engines.create discoveryengine.engines.delete discoveryengine.engines.get discoveryengine.engines.update discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.servingConfigs.search dlp.deidentifyTemplates.get dlp.deidentifyTemplates.list dlp.inspectTemplates.get dlp.inspectTemplates.list dlp.kms.encrypt dlp.locations.* dlp.locations.get dlp.locations.list integrations.integrationVersions.get integrations.integrations.generateOpenApiSpec integrations.integrations.get integrations.integrations.invoke logging.logEntries.create logging.logEntries.route run.jobs.run run.routes.invoke serviceusage.services.use storage.objects.create storage.objects.delete storage.objects.get storage.objects.update
Customer Engagement Suite Viewer ^Beta (roles/ces.viewer) Readonly access to Customer Engagement Suite resources.	ces.agents.get ces.agents.list ces.appVersions.get ces.appVersions.list ces.apps.get ces.apps.list ces.changelogs.* ces.changelogs.get ces.changelogs.list ces.conversations.get ces.conversations.list ces.deployments.get ces.deployments.list ces.evaluationDatasets.get ces.evaluationDatasets.list ces.evaluationResults.get ces.evaluationResults.list ces.evaluationRuns.get ces.evaluationRuns.list ces.evaluations.get ces.evaluations.list ces.examples.get ces.examples.list ces.guardrails.get ces.guardrails.list ces.locations.* ces.locations.get ces.locations.list ces.operations.get ces.operations.list ces.tools.get ces.tools.list ces.toolsets.get ces.toolsets.list resourcemanager.projects.get resourcemanager.projects.list

Customer Engagement Suite with Google AI permissions

Permission	Included in roles
ces.agents.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.agents.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.agents.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.agents.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.agents.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.appVersions.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.appVersions.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.appVersions.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.appVersions.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.appVersions.restore	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.apps.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.apps.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.apps.export	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Support User (roles/iam.supportUser)
ces.apps.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.apps.import	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.apps.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.apps.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.changelogs.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.changelogs.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.conversations.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.conversations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.conversations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.deployments.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.deployments.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.deployments.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.deployments.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.deployments.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationDatasets.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationDatasets.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationDatasets.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.evaluationDatasets.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.evaluationDatasets.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationResults.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationResults.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.evaluationResults.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.evaluationRuns.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluationRuns.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.evaluationRuns.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.evaluations.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluations.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.evaluations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.evaluations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.evaluations.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.examples.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.examples.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.examples.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.examples.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.examples.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.guardrails.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.guardrails.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.guardrails.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.guardrails.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.guardrails.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.locations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.locations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.operations.cancel	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.operations.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.operations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.operations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.sessions.bidiRunSession	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Client (roles/ces.client) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Dialogflow Service Agent (roles/dialogflow.serviceAgent) Customer Engagement Suite Service Agent (roles/ces.serviceAgent)
ces.sessions.runSession	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Client (roles/ces.client) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Dialogflow Service Agent (roles/dialogflow.serviceAgent) Customer Engagement Suite Service Agent (roles/ces.serviceAgent)
ces.tools.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.tools.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.tools.execute	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Client (roles/ces.client) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Dialogflow Service Agent (roles/dialogflow.serviceAgent) Customer Engagement Suite Service Agent (roles/ces.serviceAgent)
ces.tools.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.tools.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.tools.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.toolsets.create	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.toolsets.delete	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)
ces.toolsets.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Support User (roles/iam.supportUser)
ces.toolsets.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Customer Engagement Suite Admin (roles/ces.admin) Customer Engagement Suite Viewer (roles/ces.viewer) Security Admin (roles/iam.securityAdmin) Security Auditor (roles/iam.securityAuditor) Security Reviewer (roles/iam.securityReviewer) Support User (roles/iam.supportUser)
ces.toolsets.update	Owner (roles/owner) Editor (roles/editor) Customer Engagement Suite Admin (roles/ces.admin)