diff --git a/lib/towerops_web/live/agent_live/show.ex b/lib/towerops_web/live/agent_live/show.ex
index 821d203e..9fc987f7 100644
--- a/lib/towerops_web/live/agent_live/show.ex
+++ b/lib/towerops_web/live/agent_live/show.ex
@@ -10,10 +10,15 @@ defmodule ToweropsWeb.AgentLive.Show do
   def mount(%{"id" => id}, _session, socket) do
     organization = socket.assigns.current_organization
     agent_token = Agents.get_agent_token!(id)
+    current_user = socket.assigns.current_scope.user
 
-    # Verify the agent belongs to this organization
-    if agent_token.organization_id != organization.id do
-      raise Ecto.NoResultsError
+    # Verify access: agent must belong to this org OR be a cloud poller (visible to superadmin)
+    has_access =
+      agent_token.organization_id == organization.id ||
+        (agent_token.is_cloud_poller && current_user.is_superuser)
+
+    if !has_access do
+      raise Ecto.NoResultsError, queryable: Towerops.Agents.AgentToken
     end
 
     # device this agent is responsible for)