Add more permission descriptions

content/doc/book/security/access-control/permissions.adoc

@@ -5,8 +5,6 @@ layout: documentation
 :toc:
 :toclevels: 3
 
-// TODO add some more permissions
-
 The following sections describe the access granted to users with (or without) the specified permissions.
 
 == Default Permissions
@@ -107,6 +105,95 @@ Anything they cannot accomplish through the existing UI they can do through the
 An instance on which an untrusted user gained _Overall/Administer_ permission should be considered fully compromised and should be replaced.
 All secrets (credentials, etc.) stored on that instance should be rotated or revoked and all artifacts created from that point on should be verified.
 
+
+=== Agent permissions ===
+
+==== Agent/Build ====
+
+This permission allows users to run jobs as them on agents.
+
+==== Agent/Configure
+
+This permission allows users to configure agents.
+
+==== Agent/Connect
+
+This permission allows users to connect agents or mark agents as online.<br/><br/>This permission is implied by Agent/Disconnect.
+
+==== Agent/Create
+
+This permission allows users to create agents.
+
+==== Agent/Delete
+
+This permission allows users to delete existing agents.
+
+==== Agent/Disconnect
+
+This permission allows users to disconnect agents or mark agents as temporarily offline.
+
+=== Job permissions
+
+==== Job/Build
+
+This permission grants the ability to start a new build.
+
+==== Job/Cancel
+
+This permission grants the ability to cancel a scheduled, or abort a running, build.
+
+==== Job/Configure
+
+Change the configuration of a job.
+
+==== Job/Create
+
+Create a new job.
+
+==== Job/Delete
+
+Delete a job.
+
+==== Job/Discover
+
+This permission grants discover access to jobs. Lower than read permissions, it allows you to redirect anonymous users to the login page when they try to access a job url. Without it they would get a 404 error and wouldn't be able to discover project names.<br/><br/>This permission is implied by Job/Read.
+
+==== Job/Move
+
+Required to move a job from one folder (or Jenkins root) to another.
+
+==== Job/Read
+
+See a job. (You may deny this permission but allow Discover to force an anonymous user to log in to see the job.)
+
+==== Job/Workspace
+
+This permission grants the ability to retrieve the contents of a workspace Jenkins checked out for performing builds. If you don’t want a user to access files in the workspace (e.g. source code checked out from SCM or intermediate build results) through the workspace browser, you can revoke this permission.
+
+=== Run permissions
+
+==== Run/Delete
+
+This permission allows users to manually delete specific builds from the build history.
+
+==== Run/Update
+
+This permission allows users to update description and other properties of a build, for example to leave notes about the cause of a build failure.
+
+=== View permissions
+
+==== View/Configure
+This permission allows users to change the configuration of views.
+
+==== View/Create
+This permission allows users to create new views.
+
+==== View/Delete
+This permission allows users to delete existing views.
+
+==== View/Read
+This permission allows users to see views (implied by generic read access).
+
 == Optional Permissions
 
 These permissions are not enabled by default.
@@ -141,6 +228,33 @@ Learn more in jep:223[].
 NOTE: This permission was added in Jenkins 2.222.
 Some features, especially those provided by plugins, may not yet support this permission.
 
+=== Credentials permissons
+
+Following permissions are only enabled if the plugin:credentials[Credentials Plugin] is installed
+
+==== Credentials/Create
+The create permission is necessary to add credentials to a credentials provider.
+
+==== Credentials/Delete
+The delete permission is necessary to remove credentials stored in a credentials provider.
+
+==== Credentials/ManageDomains
+The manage domains permission is necessary to add/remove/configure the credential domains of a credentials provider (where the credentials provider supports multiple credential domains).
+
+==== Credentials/Update
+
+The update permission is necessary to modify credentials in a credentials provider.
+
+==== Credentials/View
+
+The view permission is necessary to view the credentials stored in a credentials provider.
+
+=== Pipleline-related permissions
+
+==== Run/Replay
+
+Ability to perform a new Pipeline build with an edited script. This permission is implied by Job/Configure.
+This permission is enabled by plugin:workflow-cps[Pipeline: Groovy].
 
 == Obsolete Permissions