Grant Runtime Access for an Activated ITSM Agent

An ITSM agent (Fulfiller or Employee) can be created and activated, yet fail the moment it's opened — its actions call platform features the user can't execute. This skill closes that gap after activation via two write-capable steps behind one confirmation:

1. Runtime action-execution permissions. Detect which feature permission sets are provisioned, let the user pick a tier per feature (user/agent vs admin) and which user(s) to grant, then assign — license first when license-gated.
2. A custom "Agent Access" permission set. Create (or reuse) Agent Access, grant the activated agents the user chooses (one SetupEntityAccess per agent), then assign it to the same user(s).

The verified feature → tier → permset matrix lives in references/permset-topology.md. No org has all three features — assign only what is provisioned and report the rest as unavailable, never failing on an absent feature.

Every read and write runs through the Salesforce CLI (sf) — no metadata XML, no token extraction, no MCP.

Scope

• In scope: detecting which platform feature permsets are provisioned; per-feature tier selection; asking which user(s) to grant (running user offered, never silent) and resolving them; PSL-then-permset assignment (license-gated tiers) idempotently; creating/reusing the custom Agent_Access permission set; adding a SetupEntityAccess grant per chosen activated agent; assigning Agent_Access to the user(s); verifying assignments by read-back.
• Out of scope (owning skill parenthesized): the Agentforce for IT Service Go toggles / Studio config (service-itsm-agentic-setup-agentforce-studio-configure); creating or activating the Employee (service-itsm-agentic-setup-employee-agent-configure) or Fulfiller (service-itsm-agentic-setup-fulfiller-agent-configure) agent; the Fulfiller activation action-surfacing gap (create/activate-time, not this runtime one — service-itsm-agentic-setup-itsm-agentforce-permset-assign); CMDB access (service-itsm-agentic-setup-cmdb-access-assign); generic non-ITSM permission-set assignment; authoring/editing feature permsets.

Helper scripts (all invoked via Bash) hold every deterministic decision (A9)

Full I/O contracts in references/helper-contracts.md.