For using the agent bakery, you need permissions to 3 roles. If you enable only "Bake agents" and "Sign agents". You won't be able to use the bake or sign button.
This is because you need the additional role "Configuration of agent updates". With these four roles, you should be able to bake and sign the agent in the agent bakery.
Why we designed this like that:
|Manage Monitoring Agents||With these permissions, you're able to see the available agents|
|Configuration of agent updates||This permission allows full control of the automatic agent updates. But not to release the agents|
|Bake Agents and Sign Agents||Bake and sign the new agents. With these permissions, you're able to release the agents|
Originally, we thought that "Configuration of agent updates" is the default role for dealing with the agents.
In the future, we might change this concept!