Permissions

Permission	Gives
Generate media with AI	The AI tabs of the Media Library. Each generation is made by the AI provider and may cost credit, so give it only to roles trusted with that.
Administer AI Media	The AI Media settings page. Restricted: it chooses providers and file handling for the whole site.

An AI tab also needs core's Create new media for that media type, as any upload tab does. Users with the AI module's Administer AI also see a tab whose generator is not set up, with a message saying how to set it up, and see the provider's own error message when a generation fails (anything shaped like a key is redacted).