This guide is for admins and Builders. By default, every internal user with a Precursive AI permission set can see every Zen Agent. This guide explains how to restrict an Agent to named viewers and Builders, and what that means for its Insights.

Before you start

Check the following before you restrict an Agent:

• The Sharing Settings tile in Precursive AI Settings > App Settings must show "Sharing is set up correctly". If the Zen Agent object is not Private, Precursive AI shows an error when you save a restricted Agent. If its related objects are not Private, everyone can still read the Context Sources, Actions, and run history of the Agent. See Set up sharing after an upgrade.
• To edit the Agent, you need the Precursive AI Insights Builder or Precursive AI Admin permission set.
• To change the members of its groups, you need the Salesforce Manage Users permission.

Restrict an Agent

When you restrict an Agent, you decide who sees it before everyone does. Common reasons are:

• A pilot of a new Agent. A small group uses the Agent first, so you can refine its instructions from their feedback before you roll it out.
• An Agent that is still in progress. Only the people who build it see its Insights, so unfinished Insights stay out of the Zen Feed for everyone else.
• An Agent for one team. For example, a margin review Agent for finance or a deal coaching Agent for sales leadership.

To restrict an Agent:

1. Open the Zen Agent record.
2. In the Agent Permissions section, clear Agent Available To All Internal Users.
3. Select Save.
4. Wait a few seconds, and then refresh the page. The Manage Viewers and Manage Builders links appear under Agent Viewers and Agent Builders when Precursive AI has created the two public groups for the Agent.

   

Until the groups exist, only the owner and admins can see the Agent. If you select Agent Available To All Internal Users again, the Agent is open to everyone, and Precursive AI keeps both groups and their members for the next time you restrict it.

Choose who can view it with Agent Viewers

Members of the Agent Viewers group can see and run the Agent and read its Insights. They still need to pass the record and field checks described in Insight sharing and access control. To set up the group:

1. Under Agent Viewers, select Manage Viewers. The group opens in Setup.
2. Select Edit.

   

3. To limit who can see the Agent, remove All Internal Users from Selected Members. The group starts with All Internal Users as its only member, so that nobody loses access when you first restrict the Agent. If you only want to limit who can edit the Agent, leave it in place.
4. Add the users, roles, roles and subordinates, or public groups that should see the Agent.
5. Select Save.

Choose who can edit it with Agent Builders

Members of the Agent Builders group can edit the Agent and add, remove, or reorder its Context Sources and Actions. The group starts empty. To add Builders:

1. Under Agent Builders, select Manage Builders. The group opens in Setup.
2. Select Edit, add the people who should be able to change the Agent, and then select Save.
3. Assign the Precursive AI Insights Builder permission set to each new Builder who does not have it.

ℹ️ Note: Group membership never assigns a permission set. Builders need the Precursive AI Insights Builder permission set to edit.

The owner of the Agent, admins with the Precursive AI Admin permission set, and anyone above the owner in the role hierarchy can always edit the Agent. You do not need to add the owner to the group.

What Agent Viewers and Agent Builders can see

When an Agent is restricted, its configuration and history follow the same groups as the Agent:

Access	Agent Viewers	Agent Builders	Everyone else
See the Agent in the Zen Feed, on record pages, in list view runs, in Flows, and in AI assistants	Yes	Yes	No
Run the Agent	Yes	Yes	No
Read its Insights	Yes, if they pass the record and field checks	Yes, if they pass the record and field checks	No
Read its Context Sources, Actions, and run history	Yes	Yes	No
Edit the Agent, and add, remove, or reorder its Context Sources and Actions	No	Yes, with the Precursive AI Insights Builder permission set	No
Read user feedback on its Insights	Yes	Yes	No

Everyone else has two exceptions. Members of the System Mode Viewers group of the Agent can see the Agent and read every Insight from it. Users with the Salesforce View All Data permission can see the Agent, its configuration, and its Insights.

A restricted Agent still runs on its schedule, whoever scheduled it.

Only the person who gave feedback, or an admin with the Precursive AI Admin permission set, can change that feedback.

When you clone a restricted Agent, Precursive AI creates new Agent Viewers and Agent Builders groups for the clone. The new Agent Viewers group starts with All Internal Users, so everyone can see the clone until you change the group. The new Agent Builders group starts empty. Set up both groups again for the clone.

Bring access up to date

Changes to group membership, including nested groups, and to the role hierarchy reach the Context Sources, Actions, and run history of an Agent automatically. Two kinds of change made directly in Salesforce do not: manual shares added with Sharing, and sharing rules on the Zen Agent object. To bring them up to date:

1. Open the Zen Agent record.
2. Open the actions menu at the top right of the record, and then select Refresh Sharing.

   

Refresh Sharing also recreates the groups of the Agent if they were deleted. A recreated group is empty, so add its members again. You need edit access to the Agent to use Refresh Sharing.