Access permissions for agents explained