To simplify management I created two roles. One that I assigned at the Tenant level:
And another for the folder level:
Then I made sure to assign the role for the Public App for the folder where my unattended automation was published:
What that looks like on the actual assignment screen:
You can validate that you’ve assigned these roles properly by checking the roles for your app under ‘Manage Access’ in Orchestrator:
pro-tip: when searching for the app when doing assignment type “UiPath-App” for it to filter correctly (this dash is important)