diff --git a/scripts/iam/authentik-provision.py b/scripts/iam/authentik-provision.py
index 1155596..789a68a 100644
--- a/scripts/iam/authentik-provision.py
+++ b/scripts/iam/authentik-provision.py
@@ -185,6 +185,10 @@ GROUP_PERMISSIONS = {
     "llm-users": ["llm:inference"],
     "memory-users": ["memory:read"],
     "memory-writers": ["memory:read", "memory:write"],
+    "s3-users": ["s3:read"],
+    "s3-writers": ["s3:read", "s3:write"],
+    "sqs-users": ["sqs:read"],
+    "sqs-writers": ["sqs:read", "sqs:write"],
 }
 perms = set()
 for group in request.user.groups.all():
@@ -806,7 +810,7 @@ print("\n[SERVICE ACCOUNTS] Creating service accounts for API access...")
 # Format: "<api>:<action>" e.g. "llm:inference", "memory:write"
 SERVICE_ACCOUNTS = {
     "portfolio-agent": {
-        "roles": ["llm:inference", "memory:read"],
+        "roles": ["llm:inference", "memory:read", "s3:read", "sqs:read"],
         "attributes": {
             "memory_projects": ["homelab", "portfolio"],
             "memory_visibility": "public",
@@ -815,7 +819,7 @@ SERVICE_ACCOUNTS = {
         "secret_name": "portfolio-agent-oidc",
     },
     "memory-agent": {
-        "roles": ["llm:inference", "memory:read", "memory:write"],
+        "roles": ["llm:inference", "memory:read", "memory:write", "s3:read", "s3:write", "sqs:read", "sqs:write"],
         "attributes": {
             "memory_projects": ["*"],
             "memory_visibility": "private",