diff --git a/docs/deploy/agent-engine.md b/docs/deploy/agent-engine.md
index 83524f1dbd..47cc8ac80a 100644
--- a/docs/deploy/agent-engine.md
+++ b/docs/deploy/agent-engine.md
@@ -145,6 +145,14 @@ remote_app = agent_engines.create(
 
 This step may take several minutes to finish.
 
+## Grant the deployed agent permissions
+
+Before proceeding to query your agent on Agent Engine, your deployed agent must first be granted additional permissions before it can use managed sessions. Managed sessions are a built-in component of Agent Engine that enables agents to keep track of the state of a conversation. Without granting the deploy agent the permissions below, you may see errors when querying your deployed agent.
+
+You can follow the instructions in [Set up your service agent permissions](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/set-up#service-agent) to grant the following permissions via the [IAM admin page](https://console.cloud.google.com/iam-admin/iam):
+
+*  Vertex AI User (`roles/aiplatform.user`) to your `service-PROJECT_NUMBER@gcp-sa-aiplatform-re.iam.gserviceaccount.com` service account
+
 ### Try your agent on Agent Engine
 
 #### Create session (remote)
@@ -201,12 +209,7 @@ Expected output for `stream_query` (remote):
 {'parts': [{'text': 'The weather in New York is sunny with a temperature of 25 degrees Celsius (41 degrees Fahrenheit).'}], 'role': 'model'}
 ```
 
-## (Optional) Grant the deployed agent permissions
-
-If the deployed agent needs to be granted any additional permissions, you can follow the instructions in [Set up your service agent permissions](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/set-up#service-agent).
 
-Deployed ADK agents need to be granted the following permissions to use managed sessions:
-* Vertex AI User (`roles/aiplatform.user`)
 
 ## Clean up