# Enabling and Configuring Marketing Super Agent (For Administrators)

## Target Audience and Purpose

This document is intended for Treasure Data account administrators (Customer IT Admin / TD Admin) and summarizes the minimum required settings to enable users to utilize the Super Agent (SA).

**For information on how end users (marketers / sales representatives) use SA, please refer to the following product documentation:**

[Using the Super Agent](/products/super-agent/about-marketing-super-agent)

This page serves as a **"Administrator Setup Guide"** to complement the above documentation.

## Overview: Who Does What

Enabling SA for users within your organization involves a two-tier approach:

### Treasure Data's Responsibilities (TD Scope)

Treasure Data enables the necessary **feature flags and various settings** for SA on the target account.

- If needed, please contact your account representative or support team.


### Customer Admin's Responsibilities

Once SA functionality is enabled by TD, the **SA icon** will appear in the target account.

However, this alone does not allow users to execute SA operations.

**Customer admins must grant appropriate permissions via Policy-Based Permission Control (PBP)** to enable users to actually utilize SA.

The following sections focus on the permission settings that customer admins need to configure.

## Required Permissions for Administrators

### Why Permission Configuration is Necessary

- SA executes processing by calling multiple backend LLM projects.
- Simply being able to open the SA icon or screen in the console does not allow actual execution of processes.
- Execution requires **"chat execution permission"** for the LLM projects used by SA.
- These permissions are granted as policies in **Policy-Based Permission Control (PBP)**.


### Target LLM Managed Projects

Users who will utilize SA must be granted access permissions to at least the following 3 managed LLM projects:

- **TD-Managed: AI Orchestrator**
- **TD-Managed: AI Task Agents P**
- **TD-Managed: AI Task Agents Q**


> **Note:** If additional Task Agent projects are added in the future for SA usage, equivalent permissions must be granted to "all LLM projects used by SA."


### Minimum Required Permission Level (Generic Chat)

The following minimum permissions are required for each LLM project:

**Generic Chat (chat) Permission**

- The minimum permission to execute queries using that project from the chat UI.
- Does not include editing agents or knowledge bases, or changing integration settings.


### Understanding General LLM Access (Full / Limited) - Admin Guidance

When configuring LLM project access in PBP, there are primarily two patterns for General LLM Access:

#### Full Access

- Allows almost all operations including creating, editing, and deleting LLM projects, as well as managing agents and knowledge bases.
- Not recommended for typical end users due to high operational risk.


#### Limited Access

- Allows granular permission assignment (e.g., Generic Chat, Project Access, Integrations Access, etc.) on a per-project basis.
- For users who will only "use" SA, the typical configuration is **Limited Access + Generic Chat permission**.


> **Note:** This document focuses on requirement-level details ("which projects need which permissions") rather than detailed UI operations (policy creation procedures, etc.). For specific PBP operation procedures, please refer to [Policy Based LLM Permissions](/products/control-panel/security/policies/policy-based-llm-permissions).


## Common Scenarios and Checkpoints (Permission-Related)

This section briefly summarizes common scenarios and checkpoints related to SA permission configuration.

### Pattern A: SA Icon Not Displayed

**Symptoms**

- Expected users cannot find the SA icon in the Treasure Data console's global navigation.


**Main Troubleshooting Areas**

#### TD-Side Layer

- Is SA functionality enabled for the target account?
- Is the target account included in an SA-supported plan?


#### Customer-Side Layer

- Is the user logged into the account/region where SA has been enabled?


If you're unsure whether SA has been enabled for your account, please contact your account representative or support team.

### Pattern B: SA Icon is Visible but Execution Results in Error

**Symptoms**

- The SA icon is displayed, the SA screen can be opened and text can be entered, but after "submitting," an error occurs and no results are returned.


**Common Causes**

**Insufficient Generic Chat permissions for LLM managed projects** is the most commonly observed issue.

Specifically, permissions may be insufficient for one or more of the following:

- TD-Managed: AI Orchestrator
- TD-Managed: AI Task Agents P
- TD-Managed: AI Task Agents Q


If you have admin privileges but cannot find the above LLM managed projects, please contact your Treasure Data representative.