Allow Org-Wide Editing Permissions for Shared Agents
under review
N
Nicole Eutsler
Currently, only the creator/owner of an agent can edit it. While agents can be shared across an organization for use, editing rights are restricted to the original creator. Other users attempting to edit a shared agent receive a "Failed to save agent" error. Custom roles and permissions do not appear to offer a workaround for this at this time.
Requested Feature:
Allow account admins or agent owners to grant editing permissions for shared agents to other users within the organization — without requiring those users to duplicate the agent into their own workspace.
Use Case / Business Need:
Teams that want to maintain a single, consistent version of an agent across their entire company are currently unable to do so collaboratively. If edits are needed, the only current option is for each user to create their own copy, which leads to version inconsistencies and defeats the purpose of a shared, company-wide agent.
The ability to collaboratively edit a single shared agent would allow organizations to:
Maintain consistent outputs across all users
Streamline agent management and updates
Avoid duplicate, out-of-sync agent copies within the same account
M
Mark Leeper
Merged in a post:
Content Protection Controls for Published Workflows, Agents, and Apps
D
Dustin McClure
=================
Summary
=================
Add a protection/lock option that MSP administrators can apply when publishing workflows, agents, or apps to managed tenants — preventing those items from being copied or cloned by tenant users.
=================
Current Behavior
=================
When an MSP publishes a workflow, agent, or app to a managed tenant, the tenant user cannot edit the published version directly. However, they are currently able to create a copy of it, which gives them full visibility into and editability of the underlying configuration. It is possible to prevent creation/deletion/duplication/etc. of workshop items via custom roles, but this would also block the user from doing these things with items created inside their tenant.
=================
Desired Behavior
=================
Introduce a per-item toggle or flag (e.g., "Copy Protection" or "Restrict Duplication") that MSP admins can enable at publish time. When enabled:
- Tenant users can use the published item as intended
- Tenant users cannot copy, clone, or duplicate the item
- The underlying configuration and structure remain opaque to the tenant
=================
Use Case / Justification
=================
MSPs invest significant time and expertise in designing and building workflows, agents, and apps for their clients. The ability for tenants to freely copy these items creates a risk that proprietary configurations could be replicated independently or migrated away from the managed service — without the knowledge or consent of the MSP who built them.
A copy protection flag would give MSPs a reasonable layer of IP protection over the work they deliver, consistent with standard white-label and managed service expectations.
=================
Suggested Implementation Options
=================
- A "Protect from copying" toggle in the publish/share dialog
- A global MSP-level policy setting that applies to all published content by default, with per-item overrides
- Optionally, an audit log showing when a tenant views or attempts to copy a protected item
=================
Priority
=================
High — this directly impacts the viability of using Hatz as a platform for delivering managed AI services to clients.
M
Mark Leeper
updated the status to
under review
M
Mark Leeper
determine best path for these competing requests
M
Mark Leeper
Merged in a post:
Separate View and Use from Edit permissions for Hatz AI assets
A
AJ Arjes-Maddox
We need to be able to mark workflows, apps, and agents as 'read only' and/or 'use only' while not restricting a user from creating their own assets. Example: User can create their own assets, but cannot either edit, or view the back-end for organization-provided assets. We need to be able to protect the structure and back-end instructions of specific AI assets while still allowing users to explore their own creativity within the Workshop.
M
Mark Leeper
Merged in a post:
Agent Instruction Security
D
Daniel Montes
I was wondering if there is a way to lock down the ability to edit agents created in the workshop. Currently, the 2 agents I created in the Finance group can be edited by team members who have access to the workshop function. My goal would be to lock down that ability and make it so that only the author(s) have access to make changes.
M
Mark Leeper
Merged in a post:
Collaborative Workshop Editing
J
James S.
Only original creators can edit agents despite being shared to others in the tenant
Q
Quinn Lynch
Merged in a post:
Agent Prompt Security
C
Craig Willard
Right now, when someone has access to an Agent, they can see the prompt. I would like to have the ability to all the Agent to be used without the user seeing the prompt. For example, I can ask the agent to show me the prompt and it will show the whole thing. If there is propritary information creating this information we dont want shared with the person using it, I have no capacity to restrict. We need the ability to protect the data in the prompt in certain circumstances.
M
Maegan Franques
Adding to this use case. In a similar fashion I have two onboarding agents that I want to use during our onboarding, but since all of our users have the ability to edit/create they would be able to change the agent. I would like the ability to set explicit permissions on individual agents so they can only be edited by selected people. Hoping this can be reviewed and updated soon!
J
James S.
Having the ability to grant read/write to others would be beneficial