---
title: Create Custom Roles for Autopilot Memories
source: https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-memories-custom-role-tutorial
---

Autopilot Memory allows Autopilot to retain context across conversations and control who can read, create, update, or delete that stored context.

## Default memory access [#default-access]

New Relic provides default access to Memory through these standard roles:

### Account-scoped access

| Action                  | Required role                                          |
| ----------------------- | ------------------------------------------------------ |
| Read memory             | Read Only, Standard User, or Full User (any user tier) |
| Create or modify memory | All-Product Admin                                      |
| Delete memory           | All-Product Admin                                      |

### Organization-scoped access

| Action                                          | Required role                                                      |
| ----------------------------------------------- | ------------------------------------------------------------------ |
| Read memory across the organization             | Organization Read Only, Organization Manager, or Org Product Admin |
| Create or modify memory across the organization | Organization Manager                                               |
| Delete memory across the organization           | Organization Manager                                               |

You might need a custom role if the default permissions don't meet your organization's needs.

## Memory capabilities [#capabilities]

When building a custom role for Memory, use the permissions below.

### Account-scoped capabilities

| Capability               | Permission identifier              |
| ------------------------ | ---------------------------------- |
| Read memory              | `context_management.read.memory`   |
| Create and update memory | `context_management.modify.memory` |
| Delete memory            | `context_management.delete.memory` |

### Organization-scoped capabilities

| Capability                                       | Permission identifier                         |
| ------------------------------------------------ | --------------------------------------------- |
| Read memory across the organization              | `context_management_org_scoped.read.memory`   |
| Create and update memory across the organization | `context_management_org_scoped.modify.memory` |
| Delete memory across the organization            | `context_management_org_scoped.delete.memory` |

## Prerequisites [#prerequisites]

Before you begin, ensure you have:

-   [General NerdGraph requirements](https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/#authentication)
-   Organization Manager role, to create custom roles

> #### 💡 TIP
>
> You can also [create a custom role for Memory through the UI](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/account-user-mgmt-tutorial/#roles). For the permissions to select and the scope to use, see [Memory capabilities](#capabilities).

## Create a custom role via the NerdGraph API [#create-role]

Each of the following API calls handles one part of creating and assigning a custom role for Memory. Expand each one for its input parameters and sample request and response.

**Find the required permission IDs for Memory**

Use the `customerAdministration` query to retrieve a list of capabilities, their permission IDs, and related information. Filter by feature to get Memory permissions.

**Input parameters**

| Parameter       | Data type | Description                                                                                                                         |
| --------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `eq` (Required) | String    | Set the value to `Memory` (account-scoped) or `Memory For Organization` (organization-scoped) to retrieve the matching permissions. |

**Sample request — account-scoped**

```graphql
{
  customerAdministration {
    permissions(filter: { feature: { eq: "Memory" } }) {
      items {
        feature
        category
        id
        product
      }
    }
  }
}
```

**Sample response**

```json
{
  "data": {
    "customerAdministration": {
      "permissions": {
        "items": [
          {
            "category": "READ",
            "feature": "Memory",
            "id": "xxxxx",
            "product": "New Relic AI"
          },
          {
            "category": "MODIFY",
            "feature": "Memory",
            "id": "xxxxxx",
            "product": "New Relic AI"
          },
          {
            "category": "DELETE",
            "feature": "Memory",
            "id": "xxxxxx",
            "product": "New Relic AI"
          }
        ]
      }
    }
  }
}
```

Run the same query with `feature: { eq: "Memory For Organization" }` to retrieve the organization-scoped permission IDs (READ, MODIFY, DELETE for Memory For Organization).

From the response, copy the permission IDs where `feature` is `Memory` or `Memory For Organization`, matching the access level you want to grant. You'll need these IDs to create the custom role.

**Retrieve your organization ID**

Retrieve your organization ID, which you'll use in subsequent mutations. For an account-scoped role, also retrieve the account ID.

**Sample request**

```graphql
{
  actor {
    organization {
      id
    }
    accounts {
      id
      name
    }
  }
}
```

**Sample response**

```json
{
  "data": {
    "actor": {
      "organization": {
        "id": "YOUR_ORGANIZATION_ID"
      },
      "accounts": [
        {
          "id": "YOUR_ACCOUNT_ID",
          "name": "Your Account Name"
        }
      ]
    }
  }
}
```

Copy the ID(s) you need from the response. You'll use them to create the custom role.

**Create the custom role**

Use the `customRoleCreate` mutation to create your custom role for Memory management.

**Input parameters**

| Parameter                  | Data type         | Description                                                                                      |
| -------------------------- | ----------------- | ------------------------------------------------------------------------------------------------ |
| `id` (Required)            | String            | The organization ID (organization-scoped) or account ID (account-scoped) from the previous call. |
| `type` (Required)          | String            | Set to `organization` for an organization-scoped role, or `account` for an account-scoped role.  |
| `name` (Required)          | String            | The display name for the custom role.                                                            |
| `permissionIds` (Required) | Array of Integers | The Memory permission IDs identified above.                                                      |
| `scope` (Required)         | String            | Set to `organization` or `account`, matching `type`.                                             |

**Sample request — account-scoped role**

```graphql
mutation {
  customRoleCreate(
    container: { id: "YOUR_ACCOUNT_ID", type: "account" }
    name: "Memory manager"
    permissionIds: [xxxxx, xxxxx]
    scope: "account"
  ) {
    id
  }
}
```

**Sample request — organization-scoped role**

```graphql
mutation {
  customRoleCreate(
    container: { id: "YOUR_ORGANIZATION_ID", type: "organization" }
    name: "Memory manager (org-wide)"
    permissionIds: [xxxxx, xxxxx]
    scope: "organization"
  ) {
    id
  }
}
```

**Sample response**

```json
{
  "data": {
    "customRoleCreate": {
      "id": 9999999
    }
  }
}
```

Save the returned role ID—you'll need it to assign this role to a user group.

**Add the custom role to a user group**

After creating the custom role, assign it to a user group.

**Retrieve group IDs**

Use the `customerAdministration` query to get a list of available user groups.

**Input parameters**

| Parameter       | Data type | Description           |
| --------------- | --------- | --------------------- |
| `id` (Required) | String    | Your organization ID. |

**Sample request**

```graphql
{
  customerAdministration {
    groups(filter: { organizationId: { eq: "YOUR_ORGANIZATION_ID" } }) {
      nextCursor
      items {
        id
        name
        users {
          items {
            id
            email
          }
        }
      }
    }
  }
}
```

From the response, copy the group ID for the group you want to assign the Memory role to.

**Assign the role to the group**

Use the `authorizationManagementGrantAccess` mutation to assign the custom role to a user group.

**Input parameters**

| Parameter            | Data type | Description                                |
| -------------------- | --------- | ------------------------------------------ |
| `roleId` (Required)  | String    | The custom role ID from the previous call. |
| `groupId` (Required) | String    | The group ID retrieved above.              |

**Sample request — account-scoped role**

```graphql
mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      accountAccessGrants: { accountId: "YOUR_ACCOUNT_ID", roleId: "YOUR_ROLE_ID" }
    }
    groupId: "YOUR_GROUP_ID"
  ) {
    roles {
      id
      name
      accountId
      roleId
      groupId
      displayName
    }
  }
}
```

**Sample request — organization-scoped role**

```graphql
mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      organizationAccessGrants: { roleId: "YOUR_ROLE_ID" }
    }
    groupId: "YOUR_GROUP_ID"
  ) {
    roles {
      id
      name
      organizationId
      roleId
      groupId
      displayName
    }
  }
}
```

**Sample response**

```json
{
  "data": {
    "authorizationManagementGrantAccess": {
      "roles": [
        {
          "displayName": "Memory manager",
          "groupId": null,
          "id": "99999999",
          "name": "memory_manager",
          "organizationId": "YOUR_ORGANIZATION_ID",
          "roleId": 99999
        }
      ]
    }
  }
}
```

For more information about Autopilot Memory, see [Autopilot Memories](https://docs.newrelic.com/docs/agentic-ai/autopilot/memories/).