[Agent Builder] Update agent builder RBAC docs

explore-analyze/ai-features/agent-builder/permissions.md

@@ -30,11 +30,40 @@ This feature requires the appropriate {{stack}} [subscription](https://www.elast
 
 ### {{kib}} privileges
 
-{{agent-builder}} access control is managed by the `agentBuilder` {{kib}} feature:
+{{agent-builder}} access control is managed by the `agentBuilder` {{kib}} feature. Assign either `Read` or `All` based on what users need to do.
 
-- "Read" access to the `agentBuilder` feature: Required to use agents, send chat messages, view tools, and access conversations.
-- "All" access to the `agentBuilder` feature: Required to create, update, or delete custom agents and tools.
-- "Read" access to the "Actions and Connectors" feature: Required to use AI connectors with agents. 
+::::{applies-switch}
+
+:::{applies-item} { stack: ga 9.4+, serverless: ga }
+#### `Read`
+
+Required to use agents, send chat messages, view tools, and access conversations.
+
+Instead of `All`, you can pair `Read` with individual sub-features for more granular control over what users can manage:
+
+- `Manage agents`: Create, update, or delete custom agents.
+- `Manage tools`: Create, update, or delete custom tools.
+
+#### `All`
+
+The broadest access level. Grants everything in `Read`, plus the ability to create, update, or delete custom agents and tools. Includes both management sub-features by default.
+:::
+
+:::{applies-item} { stack: ga 9.2-9.3 }
+#### `Read`
+
+Required to use agents, send chat messages, view tools, and access conversations.
+
+#### `All`
+
+The broadest access level. Grants everything in `Read`, plus the ability to create, update, or delete custom agents and tools.
+:::
+
+::::
+
+:::{note}
+If the agent uses AI connectors, also grant `Read` access to the {{connectors-feature}} feature.
+:::
 
 Learn more about [{{kib}} privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
 
@@ -87,7 +116,7 @@ POST /_security/role/agent-builder-full
     {
       "application": "kibana-.kibana",
       "privileges": [
-        "feature_agentBuilder.all",
+        "feature_agentBuilder.all", <1>
         "feature_actions.read"
       ],
       "resources": ["space:default"]
@@ -96,8 +125,12 @@ POST /_security/role/agent-builder-full
 }
 ```
 
-:::{tip}
-For read-only access, use `feature_agentBuilder.read` instead of `feature_agentBuilder.all`.
+1. For read-only access, use `feature_agentBuilder.read` instead of `feature_agentBuilder.all`. [Learn more](#kib-privileges).
+
+:::{note}
+:applies_to: {"stack": "ga 9.4+", "serverless": "ga"}
+
+For granular access, pair `feature_agentBuilder.read` with only the sub-feature privileges needed. To learn more, refer to [Kibana privileges](#kib-privileges).
 :::
 
 ### Grant access with API keys