This guide is for admins. Salesforce package upgrades do not change the sharing settings of an org. An org that installed Precursive AI some time ago can still let everyone see every Zen Agent and Insight, and you cannot restrict an Agent until the Zen Agent object is Private. To use the Sharing Settings tile, you need the Precursive AI Admin permission set. New installs have the recommended settings from the start.

Step 1: Check your sharing settings

The Sharing Settings tile compares each Precursive AI object with its recommended sharing setting, so you can see whether anything needs to change.

1. Open Precursive AI Settings, and then select App Settings.
2. Review the Sharing Settings tile.

If the tile shows "Sharing is set up correctly", go to Step 3. Otherwise, the tile lists each Precursive AI object that does not use its recommended setting.

Recommended setting for each object

The recommended settings differ by object, and one change cannot be reversed:

• Seven objects cannot return to Public Read/Write. After you set them to Private or Public Read Only, Zen Agent, Insight, Insight Execution, Zen Agent Context Source, Zen Agent Action, Insight Feedback, and Action Result cannot go back to Public Read/Write.
• Insight User Interaction is Private. Unlike the seven objects above, it can return to Public Read/Write.
• Three objects stay Public Read/Write. Context Source, Action, and Zen Agent Entitlement are shared configuration. Permission sets control who can change them. Action Field is Controlled by Parent, so it follows the setting of Action.

Step 2: Fix sharing

This step sets every listed object to its recommended setting, which for most objects is Private. What people can see changes as soon as Salesforce finishes recalculating. You need these Salesforce permissions: API Enabled, Manage Sharing, Customize Application, and Modify Metadata Through Metadata API Functions (or Modify All Data). If you do not have all of them, the tile lists the missing permissions and turns off Fix Sharing.

⚠️ Warning: After this step, seven Precursive AI objects cannot return to Public Read/Write. Tell your users before you start.

1. On the Sharing Settings tile, select Fix Sharing.
2. Wait for Salesforce to recalculate sharing. In a large org, this can take some time. The tile can show the old values until the recalculation finishes, and Salesforce emails you when it is done.

To make the change in Setup instead, go to Setup > Sharing Settings. Set Default Internal Access to Private for Zen Agent, Insight, Insight Execution, Zen Agent Context Source, Zen Agent Action, Insight Feedback, Action Result, and Insight User Interaction. Set Default External Access to Private for these objects and for Context Source, Action, and Zen Agent Entitlement.

Step 3: Rebuild sharing

This step gives every existing Agent, and its Context Sources, Actions, run history, and feedback, the access it should have. You need the Manage Sharing permission.

1. Check that the Sharing Settings tile shows "Sharing is set up correctly".
2. Select Rebuild Sharing.

   

Rebuild Sharing does not share existing Insights again. People get access to an existing Insight when they open it in the Zen Feed or on a record page. Email recipients and Default Share Group members get access to the new Insights from the next run of each Agent.

Step 4: Restrict your Agents

Every Agent stays open to all internal users until you restrict it. To restrict an Agent, see Control who can see and edit a Zen Agent.

Step 5: Turn on access history

Field history on Insight User Interaction shows the past access refusals of each user, not only the latest one. New installs have it turned on. In an upgraded org, turn it on yourself:

1. Go to Setup > Object Manager > Insight User Interaction > Fields & Relationships, and then select Set History Tracking.
2. Select Enable Insight User Interaction History.
3. Select Access Status, Access Denial Category, Access Denial Reason, Access Check Source, Access Denied Count, and Status.

   

4. Select Save.