and your orchestrating agent has permissions to add users?