You are here:
Mandatory Permissions for Service Assistant
Review the mandatory permissions that are required to access and use Service Assistant for all supported objects and plan types. In addition, permissions for knowledge grounding and agent actions are included here since these features are supported across all objects and plan types.
Required Editions
| View supported editions. |
Mandatory Permissions
This table lists the minimum required permissions for Service Assistant. These permissions enable Salesforce admins to set up Service Assistant and grant service reps access to draft service plans on the Case and Messaging Session record pages. All listed personas require a user role. See Create a User Role and Assign Users to Role.
| Persona | Responsibility | User License | Required Permissions |
|---|---|---|---|
| Service Assistant Admin | Sets up and manages Service Assistant, which includes the:
See Grounding Sources, Eligibility Criteria, and Set Up Service Assistant. |
Salesforce |
|
| Service Rep | Uses Service Assistant on the case or messaging session record page. |
Salesforce |
|
| Service Manager | Gathers and evaluates service plan performance metrics with Service Insights. |
Salesforce |
*Requires the Draft Service Plans with Generative AI system permission enabled for the permission set. |
| ServicePlanner User | A ServicePlanner User is created for Service Assistant when you create the agent in the Agentforce Builder. The agent user is automatically assigned the listed user license and first two standard permission sets. Agentforce_Service_Assistant Permissions is a permission set provided by Agentforce. Don't remove it. You must manually assign the Data Cloud User permission set. |
Einstein Agent |
|
Knowledge Grounding Permissions
Reference Guide: Grounding with Knowledge | Setup Steps: Set Up Knowledge Grounding
Knowledge grounding augments your subagents and instructions to create plan steps directly from your knowledge articles. All articles used to create service plans are cited both in the plan steps and in the Sources section of the component. Custom permission sets are required for knowledge grounding.
The ServicePlanner User requires a custom permission set to grant the agent access to your knowledge base so it can add the content to service plans. Service reps require a custom permission set to access and view articles cited at the end of plan steps and in the Sources section at the bottom of the component.
When you don't provide service reps the custom permission set, your knowledge articles are still used to create a service plan. However, the articles aren't cited in the service plan.
| Persona | User License | Required Permissions |
|---|---|---|
| Service Assistant Admin | Salesforce |
*Requires your default data space enabled on the permission set. See Associate a Permission Set with a Data Space. |
| Service Rep | Salesforce | Recommended custom permission set name: Service Rep Knowledge Access Permissions to include:
The custom permission set lets reps view knowledge content included in drafted service plans. |
| ServicePlanner User | Einstein Agent | Recommended custom permission set name: Agent Knowledge Access Permissions to include:
The custom permission set grants Service Assistant access to your knowledge content so it can add the content to service plans. |
Agent Action Permissions
Reference Guide: Grounding with Agent Actions
To automate the completion of plan steps, Service Assistant supports standard and custom Agentforce actions. Standard actions are generally accessible to all Agentforce agents. Always confirm specific permission requirements in the Standard Agent Action Reference.
Custom action permissions are governed by the referenced Salesforce functionality. For any custom action, make sure the ServicePlanner User has the required permissions. All actions execute under the ServicePlanner User's permissions. For example, a flow custom action respects the flow's permissions, field-level security, and sharing settings. The ServicePlanner User needs Run Flows permission to execute it.
This table outlines the general permissions required for custom actions based on the functionality used. The required permissions apply to both the ServicePlanner User and your service reps. In addtion keep these points in mind.
- Apex class access. Explicitly grant the ServicePlanner User access to each Apex class the action calls. Without it, the action fails and you see a generic error message.
- Apex sharing mode. Use actions that query customer data without sharing in the Apex class. If the class uses sharing, the query can return zero results with no error message.
- Object permissions. Grant Read access on any object the action queries. If the action also creates or updates records, add Create and Edit access.
- Field-level security. Object-level Read access isn't enough. Each field the action reads needs explicit Read access granted on the permission set. Without it, blank values are returnd.
| Action Type | Permissions |
|---|---|
| Prompt template actions | Permission Set: Prompt Template User |
| Flow actions | App Permission: Run Flows OR Grant access to individual flows |
| Apex class actions | Apex Class Access: Select the Apex classes that the agent uses. See How Does Apex Class Security Work? |
| Object used in the actions | The ServicePlanner User and Service Rep must also have access to the objects referenced by the Agentforce Actions. The required level of access, such as Read or Edit, should correspond to the action's intended function. For example, Edit permissions are necessary for actions that update records or fields. Read permissions are for actions that verify data without modifying it. |
