Agent user reassignment and permissions after a cross-org deployment
Key Takeaway
Agent metadata retrieved from a sandbox still contains the sandbox's agent username, so you must assign an agent user in the target org before you use the agent there. That agent user needs enough permissions to carry out the agent's tasks.
Moving an agent from a sandbox to production means retrieving its metadata from one org and deploying it to another. Agents run in the context of a user, and the deployed metadata still names the source org's agent user. Before the agent can run in production, it needs an agent user in the target org that has enough permissions to do the agent's tasks.
Why the agent user must be reassigned
Every agent runs in the context of a user, called the agent user. When you move an agent from a sandbox to production, the sandbox is the source org and production is the target org.
Usernames differ between the source and target orgs. So the agent metadata you retrieve from the sandbox still contains the sandbox's agent username, which doesn't match any username in the target org. As a result, you must assign an agent user in the target org before you use the agent there.