- Introduction
- Getting started
- Build on any canvas
- Build with Case
- Reference
- Defining case keys (system vs. external)
- Establishing task I/O and write-back contracts
- Modeling primary and secondary stages
- Triggering a case from Data Fabric
- Implementing stage-level personas and permissions
- Setting SLAs and automated escalation rules
- Configuring a rework loop (re-entry)
- Configuring and testing the Case Manager Agent (preview)
- Build with Flow
- Build with BPMN
- Operating
- Monitoring
- Optimizing
- Reference information
Prerequisites
Checklist of requirements for Maestro Orchestrate, covering tenant enablement, the services that Flow uses, Studio Web system requirements, and environment readiness.
Maestro Orchestrate is based on UiPath® Studio Web. For Studio Web requirements, check Automation Cloud System Requirements.
Use this checklist to verify your environment is ready for Maestro Orchestrate. It covers tenant enablement, user roles and app permissions, and Unattended licensing across tenant, machine template, and folder. Missing any item can result in pending jobs or a disabled Open in Process Mining button.
Orchestrator permissions
You need the following permissions in the Orchestrator folder where the Maestro Orchestrate process is published:
- Processes.view and Processes.edit — to view or edit Maestro Orchestrate processes.
- Jobs.view and Jobs.edit — to view or edit process instances (jobs). You can grant equivalent permissions at the folder level. For more detauls, check Default roles and permissions.
Minimum permissions for Case execution
This section lists the folder-level Orchestrator permissions needed to execute a Case process — starting cases, driving them through stages, completing tasks, and viewing case data. The built-in Automation User role covers most of these by default, but is missing a few permissions required at runtime.
Case processes are driven from one of two execution surfaces, each using a different permission family:
- Maestro Orchestrate operate view — the default surface for operators and developers. Uses the Jobs permission family.
- Case Apps — an alternative surface for business users. Uses the Apps permission family for the same operations.
Maestro Orchestrate operate view permissions
| Permission | Purpose | In Automation User by default |
|---|---|---|
| Jobs.view | View case state, stages, and execution history. | Yes |
| Jobs.create | Start or signal a case through message start or intermediate events. | Yes |
| Jobs.edit | Drive the case: reopen, select the next stage, submit events, or cancel, pause, resume, and retry. | Yes |
| Actions.view, Actions.create, Actions.edit | View and complete the human-in-the-loop Action Center tasks that the case creates. | Yes |
| Processes.view | Read the process definition backing the case. | Yes |
| Assets.view | View asset-backed values unmasked. | Yes |
| Connections.view | Execute calls to third-party integrations through Integration Service. | Yes |
| Triggers.view, Triggers.create | Register a trigger at runtime when a case pauses on a wait-for-trigger step. | No — add manually |
| Logs.view | View variable values in the Maestro Orchestrate operate view. Can be omitted for fully automated, headless execution. | No — add manually |
A case that pauses on a wait-for-trigger step registers a trigger at runtime. Without Triggers.create, this step fails with a 403 error. This requirement does not surface in a permission audit — it only appears once the case reaches the wait step.
Case Apps permissions
If users work through a Case App instead of the Maestro Orchestrate operate view, the same operations require Apps permissions instead of Jobs permissions:
| Permission | Purpose | In Automation User by default |
|---|---|---|
| Apps.view | View the case and its tasks. | Yes |
| Apps.edit | Reopen, select the next stage, or cancel the case. | No — add manually |
| Apps.create | Send a message to start or signal the case. | No — add manually |
Recommended setup
Start from the built-in Automation User role and add:
- Triggers.view and Triggers.create
- Logs.view
- Apps.view, Apps.edit, and Apps.create — only if users work through a Case App
Permissions not required
The following are not required to execute a Case process: Jobs.delete, Processes.edit, and create, edit, or delete permissions on Assets, Queues, Connections, and Storage Buckets.
Starting a case from Orchestrator is authorized by Orchestrator using the starting user's permissions. Maestro Orchestrate does not re-check this authorization.
Flow prerequisites
Flow processes use these services. Turn them on for the tenant, as Managing services describes.
| Service | What Flow processes use it for |
|---|---|
| Orchestrator | Runs deployed processes and stores their runs. Required. |
| Integration Service | The connections to other apps, such as Slack or Gmail. |
| Action Center | Human steps, such as approvals and escalations. |
| Data Fabric | Data entities that processes read and write. |
| Document Understanding and Intelligent Xtraction and Processing (IXP) | Nodes that read and extract data from documents. |
Builders usually create, test, and deploy their first Flow processes in a Personal Workspace, a private folder that belongs to each user. Turn on Personal Workspaces for the users or groups that build, as Personal workspaces describes.
To build Flow processes in VS Code, install the UiPath Maestro extension. Flow in VS Code lists what else it needs.
Execution settings
For a process invoked from Maestro Orchestrate, manage its execution settings through Package Requirements in the deployed Agentic process. Check Linking execution settings.
Unattended runtime setup
While Maestro Orchestrate itself does not require allocating a runtime, jobs started by a Maestro Orchestrate process may require Unattended runtimes. For RPA workflows invoked via Maestro Orchestrate:
- At least one user or Robot account is enabled for Unattended, assigned to the tenant, and added to the target folder. Read Unattended robot setup for configuration steps, Robot accounts for service accounts, and Managing robots for folder assignment.
- Your folder has a machine template with a runtime assigned. Check Machine templates.
Optimize tab and Process Mining
- Process Mining is enabled on your tenant. Check Enabling the service in Automation Cloud.
- Existing Maestro Orchestrate permissions let you see the Optimize tab and access the Process Optimization app.
- To edit data transformations in the auto-created Process Optimization app, you need the Process Mining Developer role. Read Setting up the users.
- You have Edit data, Edit dashboards, and View permissions for the Process Optimization app in Process Mining. Read Managing access for Process Mining apps.