This guide is for admins. It explains how Precursive AI decides who can see an Insight, the ways people get access, how to share Insights with teams and email recipients, and what happens when access changes.

Why Insights need their own access control

Precursive AI generates an Insight once per record per Agent run, and everyone who views that record reads the same Insight. An Insight can combine data from many records and fields. Without a check, a person could read a summary of an Opportunity they cannot open, or of a field they are not allowed to see.

Precursive AI closes that gap: a person sees an Insight only if they could see the data it was built from. The exceptions are System Mode and External Email Recipients, both described below. The check applies only when the sharing setting of the Insight object is Private, which is the default on new installs. If your org has used Precursive AI for some time, check this first. See Set up sharing after an upgrade.

What a viewer must pass

Before it shows an Insight, Precursive AI checks that the person could see everything behind it. The person needs all of the following:

• A Precursive AI permission set. Without one, the Precursive AI component does not appear. See Precursive AI permission sets.
• Access to the Zen Agent. If the Agent is restricted to its Agent Viewers group, people outside the group cannot see the Agent or its Insights. See Control who can see and edit a Zen Agent.
• Access to every record the Insight was built from. If they cannot open one of the records in the Insight context, the Insight stays hidden.
• Access to every field the Insight was built from. If their field-level security hides a field in the context, the Insight stays hidden.

System Mode removes some of these checks, for example so that users with a Salesforce Platform license can see Insights built from Opportunities. A Context Source in System Mode leaves its records and fields out of the record and field checks. An Agent in System Mode skips the record, field, and Agent Viewers checks for the members of its System Mode Viewers group. See Let anyone see an Insight with System Mode.

⚠️ Warning: System Mode shows Insights to people whose own access hides the data behind them. Use it only for data they may see.

How people get access

People get access to an Insight in four ways. The first two need no setup. Use the others when people need Insights before they open them, for example in reports, list views, or direct links.

Way	When it happens	Who it covers	What you set up
Zen Feed, record pages, and AI assistants	When a person opens the Zen Feed or a record, or asks an AI assistant about an Insight	Anyone who can see the Agent and passes the checks	Nothing
Salesforce access	Always	The person whose run created the Insight, people above them in the role hierarchy, and users with View All on the Insight object	Nothing
Email recipients and Default Share Groups	When the Agent finishes a run	Recipients and group members who pass the checks	Recipient fields and Default Share Groups on the Zen Agent
System Mode	For an Agent, when it finishes a run, and for its earlier Insights when you turn System Mode on. For a Context Source, when a person opens the Zen Feed or a record.	For an Agent, members of its System Mode Viewers group. For a Context Source, people who pass the remaining checks, even if they cannot read the data from that source.	Insight Access set to System Mode on the Zen Agent, or Access Control set to System Mode on the Context Source

When they open the Zen Feed or a record, or ask an AI assistant

You do not need to name people in advance for the Zen Feed or record pages to work. When someone opens the Zen Feed, it checks the latest Insights from every Agent they can see and adds the Insights they pass. The first time, the feed can take a few seconds to fill while these checks run.

The Precursive AI component on a record page runs the same check. If the person passes, they see the Insight and keep access to it. If they do not pass, the component tells them that they do not have access.

AI assistants connected through the Precursive AI MCP Server run the same check when someone asks about an Insight they have not opened yet. See Set up the Precursive AI MCP Server.

When they can already read the Insight

A person who can already read the Insight through Salesforce sees it without further checks. This includes the person whose run created it, people above them in the role hierarchy, and users with View All on the Insight object.

When the Agent finishes a run

When a run finishes, the Agent shares each Insight with its email recipients and the members of its Default Share Groups. Precursive AI checks each person against the Agent and against the records and fields the Insight was built from, and shares only the Insights they pass. Each person must also be able to see the Agent. If the Agent is restricted, add them to its Agent Viewers group.

Email recipients

Most Agents email their Insights to the people responsible for each record, such as the record owner or the Opportunity Team. The link in the email opens the Insight, and the Insight appears in their reports and list views. You set up recipients on the Email tab of the Zen Agent record. For the recipient fields, see Create Zen Agents.

Precursive AI handles recipients as follows:

• Only scheduled runs send email, and only when Email Enabled is selected on the Agent. It is not selected by default. The exception is Send preview email in Preview Insight. Runs started from a record, a list view, or a Flow share the Insights but do not send email.
• Precursive AI emails only Insights with a salience of 40 or higher. Salience runs from 0 to 100, and the threshold is fixed. Salience Instructions on the Agent guide how each Insight is scored.
• Each recipient receives, and gets access to, only the Insights they pass. A recipient who does not pass the check for an Insight does not receive it.
• For Recipient Groups, Precursive AI includes only users who are direct members of the public group or queue. It does not include people in nested groups or roles.

Default Share Groups

Use Default Share Groups when a team needs the Insights of an Agent without an email. For example, a delivery leadership team reviews every Project Insight in a weekly report, or a sales manager works through a list view. To set up Default Share Groups:

1. Create a public group for the team, or use an existing one, and add each member as an individual user.
2. Open the Zen Agent record.
3. In Default Share Groups, enter the API name (DeveloperName) of the group. To add more than one group, separate the names with commas, for example Sales_Team,Delivery_Leads.
4. Select Save.

Members do not receive an email. Only direct user members get access. People inside a nested public group, a role, or a role and its subordinates do not get access, and no error appears. Add the nested groups to Default Share Groups separately, or add the users to the group directly. The setting uses API names rather than IDs, so it works in both sandbox and production.

💡 Tip: Nesting works in the Agent Viewers group but not in Default Share Groups. Add users to share groups directly.

External email recipients

Use External Email Recipients when someone without a Salesforce login needs the Insights of an Agent, for example a shared analytics inbox. Enter their email addresses in External Email Recipients, separated by commas.

External recipients are the only email recipients that Precursive AI does not check. They have no Salesforce user, so Precursive AI has nothing to check them against. They receive every Insight the Agent emails, whatever data it was built from. Their emails do not include action buttons or feedback links, because they cannot sign in.

⚠️ Warning: External recipients receive every Insight the Agent emails. Add only addresses you trust to see all of that data.

With System Mode

An Agent with Insight Access set to System Mode shares the Agent and every Insight from it, past and future, with its System Mode Viewers group. Members see the Agent and its Insights in the Zen Feed, on record pages, in reports and list views, and in AI assistants. This applies even if they are not in the Agent Viewers group and their own access would hide the data.

A Context Source with Access Control set to System Mode leaves its records and fields out of the check. People pass when they open the Insight, even if they cannot read that data. An admin must allow System Mode before either setting takes effect. See Let anyone see an Insight with System Mode.

When records are deleted

If a record in the Insight context is deleted after the Agent runs, Precursive AI can no longer check it. Precursive AI checks the parent record instead, where there is one, for example the Project that a deleted Timesheet Entry belonged to. A deleted record from an object that everyone can read does not block access. Any other deleted record blocks access until the Agent runs again and produces a new Insight.

When access changes

A person keeps access to an Insight after they are granted it. If they later lose access to one of its records, or an admin sets a Context Source back to User Mode or disallows System Mode, they can still see the Insights they could see before. Precursive AI checks every new Insight against their current access, so a regular Agent schedule moves people on to Insights that match their access today.

The System Mode Viewers group is the exception. If you remove someone from the group, set the Agent back to User Mode, or disallow System Mode, they lose the access that the group gave them.

Related articles

These articles explain how to set up access and how to fix it when someone cannot see an Insight:

• Control who can see and edit a Zen Agent
• Let anyone see an Insight with System Mode
• Troubleshoot Insight access
• Set up sharing after an upgrade