When you create it, the JSON with environment variables includes admin_role and api_role. The first takes the name of a role you want to use for people who can sign in to the Node-RED UI. The second takes the name of a role you want to use for people who can access HTTP endpoints in Node-RED. If you leave the last one blank, there will not be any authentication for HTTP endpoints; this is the default.
Thank you @Allan_Zimmermann ,
Setting the variables worked when I created a new Agent, but it does not work when updating the variables for an existing Agent.
Anyway, the main problem is solved.