All Products
Search

This Product

    AgentLoop:RAM permission policy reference

    Document Center

    AgentLoop:RAM permission policy reference

    Last Updated:Jul 10, 2026

    When you use the AgentLoop service, different users may require different access permissions. In this case, the Alibaba Cloud account owner can configure different RAM permission policies to implement access control on AgentLoop resources.

    Permission policy types

    If you use RAM, request the required permission policies from the Alibaba Cloud account owner. For information about how to grant permissions, see Manage RAM user permissions.

    Alibaba Cloud provides two types of policies: system policies and custom policies.

    • System policies: created and maintained by Alibaba Cloud. They are easy to use but cannot be modified.

    • Custom policies: defined by users. If system policies do not meet your requirements, you can create custom policies to implement fine-grained access control based on the principle of least privilege.

    System policies

    System policies are created by Alibaba Cloud and their versions are maintained by Alibaba Cloud. Users can only use but cannot modify these policies. The following system policies are available for AgentLoop:

    • AliyunAgentLoopFullAccess: grants full access permissions on AgentLoop.

    • AliyunAgentLoopReadOnlyAccess: grants read-only access permissions on AgentLoop.

    Custom policies

    Use case: You want to configure fine-grained access control for RAM users and RAM roles. You can add custom policy statements as needed. This approach is suitable for scenarios that require fine-grained permission management.

    Read permissions

    Policy statement

    Description

    		 
    {
      "Action": [
        "agentloop:Get*",
        "agentloop:List*",
        "agentloop:Describe*",
        "agentloop:ExecuteQuery"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

    Read permissions on the AgentLoop service, including agent spaces, datasets, and experience libraries.

    		 
    {
    "Action": [
        "log:GetLogStoreLogs",
        "log:GetLogStoreHistogram",
        "log:GetIndex",
        "log:GetLogStore",
        "log:GetProject",
        "log:ListLogStores",
        "log:ListProject"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Permissions to query data in existing Logstores of Simple Log Service.

    		 
    {
    "Action": [
        "airegistry:ListNamespaces",
        "airegistry:ListPrompts",
        "airegistry:ListPromptVersions",
        "airegistry:ListSkills",
        "airegistry:GetNamespace",
        "airegistry:GetPrompt",
        "airegistry:GetPromptVersion",
        "airegistry:GetPromptVersionDetail",
        "airegistry:GetPromptGovernance",
        "airegistry:GetSkillDetail",
        "airegistry:GetSkillVersionDetail",
        "airegistry:DownloadSkillVersion",
        "airegistry:DownloadSkillVersionViaOss"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Read permissions on prompts and skills in AI Governance Center.

    		 
    {
    "Action": [
        "cms:GetWorkspace",
        "cms:GetEntityStoreData",
        "cms:GetServiceObservability",
        "cms:GetUmodelCommonSchemaRef",
        "cms:GetAddon",
        "cms:GetAddonSchema",
        "cms:GetAddonCodeTemplate",
        "cms:GetAddonMetrics",
        "cms:GetAddonAlertTemplates",
        "cms:GetAddonRelease",
        "cms:GetPrometheusUserSetting",
        "cms:GetCmsService",
        "cms:GetCloudResource",
        "cms:GetCloudResourceData",
        "cms:ListWorkspaces",
        "cms:ListServices",
        "cms:ListAddons",
        "cms:ListIntegrationPolicies",
        "cms:ListAddonReleases",
        "cms:ListIntegrationPolicyResources",
        "cms:ListIntegrationPolicyCollectors",
        "cms:ListPrometheusInstances"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Read permissions on CloudMonitor 2.0 workspaces, data entities, addons, APM services, and Umodel.

    		 
    {
      "Action": [
"resourcecenter:GetResourceCenterServiceStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }

    Permissions to query the service status of Resource Center.

    Write permissions

    In addition to the read permissions, the following write permissions are required:

    Policy statement

    Description

    		 
      {
    "Action": [
      "agentloop:*"
    ],
    "Resource": "*",
    "Effect": "Allow"
  }

    Full management permissions on the AgentLoop service.

    		 
    {
    "Action": [
        "airegistry:CreatePrompt",
        "airegistry:UpdatePrompt",
        "airegistry:DeletePrompt",
        "airegistry:CreatePromptVersion",
        "airegistry:UpdatePromptVersion",
        "airegistry:SubmitPromptVersion",
        "airegistry:DeletePromptVersion",
        "airegistry:CreateSkillDraft",
        "airegistry:UpdateSkillDraft",
        "airegistry:DeleteSkillDraft",
        "airegistry:SubmitSkillVersion",
        "airegistry:PublishSkillVersion",
        "airegistry:ForcePublishSkillVersion",
        "airegistry:UpdateSkillBizTags",
        "airegistry:UpdateSkillLabels",
        "airegistry:OnlineSkill",
        "airegistry:OfflineSkill",
        "airegistry:UpdateSkillScope",
        "airegistry:DeleteSkill",
        "airegistry:UploadSkill",
        "airegistry:UploadSkillViaOss"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Full permissions on prompts and skills in AI Governance Center, including creation, editing, publishing, deletion, and debugging.

    		 
    {
    "Action": [
        "log:CreateIndex",
        "log:CreateLogStore"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Permissions to create Logstores and configure indexes in Simple Log Service.

    		 
    {
    "Action": [
        "cms:CreateService",
        "cms:CreateIntegrationPolicy",
        "cms:CreateAddonRelease",
        "cms:CreateCloudResource",
        "cms:CreateServiceObservability",
        "cms:ProxyApiForMemberAccount",
        "cms:UpsertUmodelCommonSchemaRef",
        "cms:UpsertUmodelData"
    ],
    "Resource": "*",
    "Effect": "Allow"
}

    Permissions to create and modify CloudMonitor 2.0 workspaces, APM services, observability services, and Umodel.

    		 
    {
    "Action": "ram:CreateServiceLinkedRole",
    "Resource": "*",
    "Effect": "Allow",
    "Condition": {
        "StringEquals": {
            "ram:ServiceName": [
                "agentloop.aliyuncs.com"
            ]
        }
    }
}

    Permissions to create the service-linked role for AgentLoop.