From c3032726c492203e388733f6402ee7792df36516 Mon Sep 17 00:00:00 2001 From: Owais Kazi Date: Tue, 7 Apr 2026 12:11:24 -0700 Subject: [PATCH 1/3] Add indices:admin/mappings/get to ml_full_access role Signed-off-by: Owais Kazi --- config/roles.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/roles.yml b/config/roles.yml index ff09b706ff..99f3b699e5 100644 --- a/config/roles.yml +++ b/config/roles.yml @@ -333,6 +333,7 @@ ml_full_access: - '*' allowed_actions: - 'indices_monitor' + - 'indices:admin/mappings/get' # Allows users to use all Notifications functionality notifications_full_access: From 7a14561f8e5d2ecfcf62ef343c865cd49bb78a89 Mon Sep 17 00:00:00 2001 From: Owais Kazi Date: Tue, 7 Apr 2026 12:14:09 -0700 Subject: [PATCH 2/3] Fix permission ordering in ml_full_access role Signed-off-by: Owais Kazi --- config/roles.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/roles.yml b/config/roles.yml index 99f3b699e5..73f1326699 100644 --- a/config/roles.yml +++ b/config/roles.yml @@ -332,8 +332,8 @@ ml_full_access: - index_patterns: - '*' allowed_actions: - - 'indices_monitor' - 'indices:admin/mappings/get' + - 'indices_monitor' # Allows users to use all Notifications functionality notifications_full_access: From 75b48d7571e78775baf9f11ee9fcb667df24e7c6 Mon Sep 17 00:00:00 2001 From: Owais Kazi Date: Fri, 10 Apr 2026 11:22:35 -0700 Subject: [PATCH 3/3] Add indices:data/read/search* to ml_full_access for Agentic Search QueryPlanningTool samples documents from the target index using a matchAllQuery search. This requires indices:data/read/search* permission which is consistent with other full_access roles (anomaly_full_access, ppl_full_access, asynchronous_search_full_access, forecast_full_access). Signed-off-by: Owais Kazi --- config/roles.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/roles.yml b/config/roles.yml index 73f1326699..7f12c8c382 100644 --- a/config/roles.yml +++ b/config/roles.yml @@ -333,6 +333,7 @@ ml_full_access: - '*' allowed_actions: - 'indices:admin/mappings/get' + - 'indices:data/read/search*' - 'indices_monitor' # Allows users to use all Notifications functionality