Please provide more input, e.g. a screenshot listing the agents that are defined (from .../computer) would be helpful

Is your intention to define permissions on the built-in agent?

define permission for master and cloud agents

remember that you have to use regular expressions, so

(?i)restricted-agent*

should probably be

(?i).*restricted-agent.*

This will not match labels given to agents.

And 'master' will only match an agent with name 'master'. As mentioned before the controller itself is not using the term 'master' anymore.

thank you it worked 

Could you please help me with this

I have 2 users, user1 and user2 I want to allow only user1 to run the Jenkins job in restricted-agent 

I have set the permissions like this but user2 can also provision the Jenkins job with the following permissions, I am not sure what is wrong here 

could you please help me with what I am missing here?

You will need the plugin https://plugins.jenkins.io/authorize-project/ and configure it as 'run as user who triggered the build' to be able to restrict who can run builds on a node. By default builds are executed as the the SYSTEM user that acts like an admin.

OK thank you so much, let me try that 

If you want to allow to run on all agents I would define a global role instead of an agent role that tries to match everything.

Currently it seems that it is not possible to define an agent role that matches the built-in controller. But building on the controller is not recommended anyway.

I want to define a role for each agent, I just tried this to show that the built-in agent was not shown in the list 

Is there any other way, we could define a role for the built-in controller ? and allow only few users to run job there ?

At the moment it seems to be not possible to define a rule for the built-in. I haven't yet understood why this is the case, need to debug this

could we get this feature to set a role on built-in agent also ?

After analyzing the code in Jenkins core it is not possible to define an agent role for the built-in node. The reason is that Jenkins itself is a Node and overwrites the getACL() method defined in the Node class. So when it comes to checking the permissions for the built-in node, the root ACL is returned.

Without digging in the details the same is probably true for Matrix auth.

Closing this as role patterns for agents work without problems.

The build permission for agents works only when the authorize-project plugin is installed.

A role that matches the controller itself is not possible due to the way this is implemented in core.

thanks, mawinter69 for all the support,

I have one question why do builds are kept in the queue if the user is lacking permission, can't we abort the job automatically if the user is lacking permission to run in a specific agent?

Aborting builds is out of scope for role-strategy plugin.

While it might be a use case for you to remove builds in the queue this might not be true for others in all cases. Not sure if it is possible to achieve this via a plugin.