Create Custom Roles for Autopilot Memories

Autopilot Memory allows Autopilot to retain context across conversations and control who can read, create, update, or delete that stored context.

Default memory access

New Relic provides default access to Memory through these standard roles:

Account-scoped access

Action	Required role
Read memory	Read Only, Standard User, or Full User (any user tier)
Create or modify memory	All-Product Admin
Delete memory	All-Product Admin

Organization-scoped access

Action	Required role
Read memory across the organization	Organization Read Only, Organization Manager, or Org Product Admin
Create or modify memory across the organization	Organization Manager
Delete memory across the organization	Organization Manager

You might need a custom role if the default permissions don't meet your organization's needs.

Memory capabilities

When building a custom role for Memory, use the permissions below.

Account-scoped capabilities

Capability	Permission identifier
Read memory	`context_management.read.memory`
Create and update memory	`context_management.modify.memory`
Delete memory	`context_management.delete.memory`

Organization-scoped capabilities

Capability	Permission identifier
Read memory across the organization	`context_management_org_scoped.read.memory`
Create and update memory across the organization	`context_management_org_scoped.modify.memory`
Delete memory across the organization	`context_management_org_scoped.delete.memory`

Prerequisites

Before you begin, ensure you have:

General NerdGraph requirements
Organization Manager role, to create custom roles

Tip

You can also create a custom role for Memory through the UI. For the permissions to select and the scope to use, see Memory capabilities.

Create a custom role via the NerdGraph API

Each of the following API calls handles one part of creating and assigning a custom role for Memory. Expand each one for its input parameters and sample request and response.

Use the customerAdministration query to retrieve a list of capabilities, their permission IDs, and related information. Filter by feature to get Memory permissions.

Input parameters

Parameter	Data type	Description
`eq` (Required)	String	Set the value to `Memory` (account-scoped) or `Memory For Organization` (organization-scoped) to retrieve the matching permissions.

Sample request — account-scoped

{
  customerAdministration {
    permissions(filter: { feature: { eq: "Memory" } }) {
      items {
        feature
        category
        id
        product
      }
    }
  }
}

Sample response

{
  "data": {
    "customerAdministration": {
      "permissions": {
        "items": [
          {
            "category": "READ",
            "feature": "Memory",
            "id": "xxxxx",
            "product": "New Relic AI"
          },
          {
            "category": "MODIFY",
            "feature": "Memory",
            "id": "xxxxxx",
            "product": "New Relic AI"
          },
          {
            "category": "DELETE",
            "feature": "Memory",
            "id": "xxxxxx",
            "product": "New Relic AI"
          }
        ]
      }
    }
  }
}

Run the same query with feature: { eq: "Memory For Organization" } to retrieve the organization-scoped permission IDs (READ, MODIFY, DELETE for Memory For Organization).

From the response, copy the permission IDs where feature is Memory or Memory For Organization, matching the access level you want to grant. You'll need these IDs to create the custom role.

Retrieve your organization ID, which you'll use in subsequent mutations. For an account-scoped role, also retrieve the account ID.

Sample request

{
  actor {
    organization {
      id
    }
    accounts {
      id
      name
    }
  }
}

Sample response

{
  "data": {
    "actor": {
      "organization": {
        "id": "YOUR_ORGANIZATION_ID"
      },
      "accounts": [
        {
          "id": "YOUR_ACCOUNT_ID",
          "name": "Your Account Name"
        }
      ]
    }
  }
}

Copy the ID(s) you need from the response. You'll use them to create the custom role.

Use the customRoleCreate mutation to create your custom role for Memory management.

Input parameters

Parameter	Data type	Description
`id` (Required)	String	The organization ID (organization-scoped) or account ID (account-scoped) from the previous call.
`type` (Required)	String	Set to `organization` for an organization-scoped role, or `account` for an account-scoped role.
`name` (Required)	String	The display name for the custom role.
`permissionIds` (Required)	Array of Integers	The Memory permission IDs identified above.
`scope` (Required)	String	Set to `organization` or `account`, matching `type`.

Sample request — account-scoped role

mutation {
  customRoleCreate(
    container: { id: "YOUR_ACCOUNT_ID", type: "account" }
    name: "Memory manager"
    permissionIds: [xxxxx, xxxxx]
    scope: "account"
  ) {
    id
  }
}

Sample request — organization-scoped role

mutation {
  customRoleCreate(
    container: { id: "YOUR_ORGANIZATION_ID", type: "organization" }
    name: "Memory manager (org-wide)"
    permissionIds: [xxxxx, xxxxx]
    scope: "organization"
  ) {
    id
  }
}

Sample response

{
  "data": {
    "customRoleCreate": {
      "id": 9999999
    }
  }
}

Save the returned role ID—you'll need it to assign this role to a user group.

After creating the custom role, assign it to a user group.

Retrieve group IDs

Use the customerAdministration query to get a list of available user groups.

Input parameters

Parameter	Data type	Description
`id` (Required)	String	Your organization ID.

Sample request

{
  customerAdministration {
    groups(filter: { organizationId: { eq: "YOUR_ORGANIZATION_ID" } }) {
      nextCursor
      items {
        id
        name
        users {
          items {
            id
            email
          }
        }
      }
    }
  }
}

From the response, copy the group ID for the group you want to assign the Memory role to.

Assign the role to the group

Use the authorizationManagementGrantAccess mutation to assign the custom role to a user group.

Input parameters

Parameter	Data type	Description
`roleId` (Required)	String	The custom role ID from the previous call.
`groupId` (Required)	String	The group ID retrieved above.

Sample request — account-scoped role

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      accountAccessGrants: {
        accountId: "YOUR_ACCOUNT_ID"
        roleId: "YOUR_ROLE_ID"
      }
    }
    groupId: "YOUR_GROUP_ID"
  ) {
    roles {
      id
      name
      accountId
      roleId
      groupId
      displayName
    }
  }
}

Sample request — organization-scoped role

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: { organizationAccessGrants: { roleId: "YOUR_ROLE_ID" } }
    groupId: "YOUR_GROUP_ID"
  ) {
    roles {
      id
      name
      organizationId
      roleId
      groupId
      displayName
    }
  }
}

Sample response

{
  "data": {
    "authorizationManagementGrantAccess": {
      "roles": [
        {
          "displayName": "Memory manager",
          "groupId": null,
          "id": "99999999",
          "name": "memory_manager",
          "organizationId": "YOUR_ORGANIZATION_ID",
          "roleId": 99999
        }
      ]
    }
  }
}

For more information about Autopilot Memory, see Autopilot Memories.

Create Custom Roles for Autopilot Memories

Default memory access

Account-scoped access

Organization-scoped access

Memory capabilities

Account-scoped capabilities

Organization-scoped capabilities

Prerequisites

Tip

Create a custom role via the NerdGraph API

Find the required permission IDs for Memory

Retrieve your organization ID

Create the custom role

Add the custom role to a user group

Create Custom Roles for Autopilot Memories

Default memory access .css-21sua1{background:none;border:none;width:0;padding:0;}

Account-scoped access

Organization-scoped access

Memory capabilities

Account-scoped capabilities

Organization-scoped capabilities

Prerequisites

Tip

Create a custom role via the NerdGraph API

Retrieve your organization ID

Create the custom role

Add the custom role to a user group

Default memory access