# Sharing and permissions

## Who can share agents[​](#who-can-share-agents "Direct link to Who can share agents")

You will be able to share your agents with others if:

* You are an *admin* or *agent moderator*
* Your admin has enabled the applicable default member sharing permission. See [Enable group sharing for default members](/administration/managing-agents/agent-group-sharing.md#enable-group-sharing-for-default-members)

Sharing and publishing are separate permissions. Editor access lets a user edit an agent, but it doesn't by itself allow the user to publish the agent.

## Who can publish agents[​](#who-can-publish-agents "Direct link to Who can publish agents")

You can publish an agent if one of the following applies:

* You are an *admin* or *agent moderator*
* You have the *Agent Creator* role and can edit the agent. Agent creators can publish private, shared, and company-wide agents, regardless of the default-member publish settings.
* As a default member with `agent-create` permission, you can publish private agents. For shared and company-wide agents, the applicable default-member sharing or publishing setting also has to allow it.

A default member without `agent-create` permission can't publish an agent, even if they have editor access.

## How to share an agent[​](#how-to-share-an-agent "Direct link to How to share an agent")

In the agent builder, click **Share** in the header. You can share an agent with individuals, departments, and identity provider groups when your admin has enabled group sharing. Each agent has one owner who is responsible for it.

Admins and Agent Moderators can share with all groups from the configured identity provider. Default members can share with groups they belong to when the admin enables the corresponding default-member permission. See [Share agents with identity provider groups](/administration/managing-agents/agent-group-sharing.md) for setup details.

note

Your admin sets the maximum audience you can share an agent with. Depending on this setting, you can share with specific people, people in your department, configured identity provider groups, or everyone in your organization. The Share dialog shows only options within this limit. If your admin tightens the limit, existing shares remain unchanged, but new shares follow the updated limit.

![](/assets/images/image1-83692f563bbde396bef200204bb62109.png)

## Grant agent access from a chat[​](#grant-agent-access-from-a-chat "Direct link to Grant agent access from a chat")

When you share a chat about a shareable published agent, select **Also share agent** in the share dialog to grant eligible recipients Viewer access. Glean selects this option by default. Agent sharing rules still apply, which means some chat recipients might not qualify for access.

Viewers can find the agent in the library, view its configuration, and run it. Viewers cannot edit the agent. A chat link alone does not grant agent access. Likewise, removing a recipient from a chat does not revoke agent access. To manage agent permissions, use the agent **Share** dialog.

For chat sharing steps and recipient eligibility details, see [Share chats](/user-guide/assistant/chat-sharing.md#share-agent-access).

## Transfer ownership[​](#transfer-ownership "Direct link to Transfer ownership")

Only the current owner, Agent Moderators, and Admins can transfer ownership.

To transfer ownership:

1. Open the agent in the **Agent builder** and click **Share**.
2. Select the individual who should own the agent.
3. Confirm the ownership transfer.

The new owner gets Owner access. The previous owner becomes an Editor and keeps edit access unless you remove it separately. The agent's creator history does not change when ownership transfers.

You can share an agent with departments and identity provider groups, but you can't assign them Owner access. Grant these audiences Viewer or Editor access instead.

### Auto-generate agent description[​](#auto-generate-agent-description "Direct link to Auto-generate agent description")

When you share an agent that does not have a description, Glean automatically suggests an icon and an AI-generated description. You can review, edit, or replace the suggested description before confirming the share.

This feature helps keep the agent library organized and makes it easier for users to understand what each agent does. Descriptions remain optional—you can still share agents without one—but the auto-generation workflow reduces friction and encourages best practices.

To use autogenerated descriptions:

1. Open the Agent Builder and click the **Share** button when you're ready to share your agent.
2. If your agent doesn't have a description, a modal appears with a suggested icon and autogenerated description.
3. Review, edit, or replace the suggested description.
4. Confirm the share to save the description.

tip

You can also use the **Enhance** button (sparkle icon) next to the description field in Agent Settings to generate or refine a description at any time, even after saving.

The table below shows the capabilities that are granted by each permission.

|                             | No Access | Viewer | Editor | Owner |
| --------------------------- | --------- | ------ | ------ | ----- |
| See agent in the library    | No        | Yes    | Yes    | Yes   |
| Run agent                   | No        | Yes    | Yes    | Yes   |
| View configuration of agent | No        | Yes    | Yes    | Yes   |
| Edit agent                  | No        | No     | Yes    | Yes   |
| Change permissions of agent | No        | No     | Yes    | Yes   |
| Delete agent                | No        | No     | No     | Yes   |
| Transfer ownership          | No        | No     | No     | Yes   |

note

* You can grant the **Editor** permission to users who collaborate with you on building an agent. Editors can edit your agent even if your admin did not give them permission to create agents.
* An agent can have only one owner at a time. The current owner, Agent Moderators, and Admins can transfer ownership.
* **Super admins** and **Admins** have the **Owner** permission on all agents at the company.
* These permissions will be enforced everywhere, including if the agent is called via Slack or the API.

## Existing agents with multiple owners[​](#existing-agents-with-multiple-owners "Direct link to Existing agents with multiple owners")

Glean is transitioning agents to a single-owner model.

When this change is enabled, Glean automatically sends co-owners an advance notice email specifying the affected agents and the two-week migration timeline.

**How to resolve ownership before the deadline:** Before the migration date, an owner or admin can open **Share** for any affected agent and select a single primary owner.

**Automatic migration fallback**: Receiving the advance notice email does not change permissions immediately. However, if no one manually updates ownership before the migration date, Glean automatically assigns a single owner using the following rules and changes all other co-owners to **Editors**:

* **If the agent creator is still an owner:** The creator remains the primary owner.
* **If the creator is no longer an owner:** Glean selects the remaining owner whose name comes first alphabetically.

note

Creator history remains unchanged regardless of who becomes the primary owner.

## When an owner is deactivated[​](#when-an-owner-is-deactivated "Direct link to When an owner is deactivated")

When an agent owner is deactivated, Glean reassigns ownership to that person's manager. If manager information is unavailable, Glean assigns the agent to an Agent Moderator. The new owner receives an email notification and can transfer ownership again if needed.

## Document access across surfaces[​](#document-access-across-surfaces "Direct link to Document access across surfaces")

The document access an agent uses depends on where it's invoked and how it's configured.

In the Glean web app, the agent uses the signed-in user's individual permissions. The agent can reference any document that the user has access to, so responses are personalized to each user.

In Slack, permissions depend on the visibility setting you choose when [publishing the agent to Slack](/agents/concepts/publish-slack.md):

* Only visible to user (with or without the option to share): The agent uses the requesting user's individual permissions, similar to the web app experience.
* Visible to everyone in the channel: The agent uses a broad-access model rather than your personal permissions. By default, it can reference public content across your organization and messages from the current Slack channel, if recognized. It does not check if every member of the channel has permission to view each document. Depending on the settings of your organization, it may also include approved code repositories.

This model prevents private or restricted content from accidentally being shared in public channels.

Troubleshooting different responses across surfaces

If an agent produces different or more limited responses in Slack compared to the web app:

* To align Slack behavior with the web experience, change the agent's Slack publishing setting to "Only visible to user" with an option to share. This lets the agent use each user's individual permissions.
* To keep responses visible to everyone, ensure that the reference documents for the agent meet the broad-access requirements of Option C. See [Publishing to Slack](/agents/concepts/publish-slack.md#broadly-shared-content-used-by-the-agent-in-option-c).

## Publishing options[​](#publishing-options "Direct link to Publishing options")

The share panel displays publishing options that apply to the selected agent:

### API[​](#api "Direct link to API")

The **API** option appears first under **Publishing options**. Use it to create a Client API token for the selected agent.

An agent **Owner** or **Editor** can create and delete their own token from **Share** → **API** when they also have the **Agent Creator** role.

If an identity provider group gives you Editor access to an agent, Glean counts that as Editor access. **Admins**, **Agent Moderators**, and users with the **API Token Creator** role retain their existing token-management access.

Glean scopes tokens from this panel to the selected agent. API requests use the current permissions of the user who created the token, so the token does not grant access to other agents or additional source content.

#### Token security and maintenance[​](#token-security-and-maintenance "Direct link to Token security and maintenance")

* The token secret appears only once during creation. Copy it and store it securely before you leave the page. You cannot recover it later.
* A scoped agent token expires one year after creation.
* To rotate a token, delete it and create a new one.

For more information, see [API tokens](/administration/developer/api-tokens.md#client-api-tokens-for-specific-agents).

### Slack (agents with chat message triggers only)[​](#slack-agents-with-chat-message-triggers-only "Direct link to Slack (agents with chat message triggers only)")

Publishing an agent to Slack lets users interact with the agent in Slack. The agent can respond to messages, perform tasks, or provide information in Slack channels.