[Feature Enhancement Request] Add Action Moderator Role

Brian Lunsford

Overview

We have several requests from our Glean users to grant them the Action Creator role so they can create custom actions to interact with their applications.

We have held back on broadly granting this role due to the current permission model and lifecycle-management limitations around custom actions.

Current Behavior and Limitations

Today, our understanding of the roles and capabilities for custom actions is:

• A user with the Action Creator role can only update the custom actions that they created.
• A user with the Admin role can update any custom action in Glean.
• A user with the Admin role cannot change the owner of a custom action. If the original creator leaves the company, the admin users are now responsible for maintaining that custom action indefinitely, without any way to re-assign ownership.

These constraints create a few practical issues:

1. Risk in granting Action Creator widely
   To allow power users and application owners to manage their own custom actions, we would need to grant them Action Creator. However, if they leave the company, we end up with “orphaned” actions that admins must maintain without being able to reassign ownership.
2. Overloading the Admin role
   Because only Admins can update any custom action, support and maintenance tasks for actions created by others often fall on a small set of Admins. This mixes routine operational work (fixing or tweaking actions) with high-privilege administrative capabilities that we may not want to grant to the same people.
3. Poor lifecycle management for custom actions
   When an action owner changes teams or leaves the organization, we cannot:
   • Transfer ownership to a new application owner.
   • Delegate responsibility for a group of related actions to a specialized “actions” support team. This makes it harder to treat custom actions as long-lived, governed integration assets.

Proposed Enhancement: Action Moderator Role

We propose introducing a new Action Moderator role that sits between Action Creator and Admin, focused specifically on the operational and lifecycle management aspects of custom actions.

High-Level Goals

• Enable a dedicated group (e.g., integration support, automation CoE, or app owner team) to manage and maintain all custom actions.
• Avoid having to grant full Admin privileges to users who only need to administer custom actions.
• Provide a clean way to reassign ownership of custom actions when people change roles or leave the company.

Suggested Capabilities for Action Moderator

An Action Moderator should be able to:

1. View and edit any custom action
   • Update configuration, prompts, parameters, and mappings for any existing custom action.
   • Enable/disable actions (for incident response or deprecation scenarios).
2. Reassign ownership of custom actions
   • Change the owner of a custom action to another user.
   • Optionally, bulk reassign ownership for all actions created by a given user (e.g., when a user departs).
3. Manage action lifecycle
   • Archive or delete custom actions that are no longer needed.
   • Optionally tag, categorize, or otherwise organize actions if such metadata is available in the UI.
4. Scoped privileges compared to Admin
   • No access to global admin capabilities such as:
     • Organization-wide configuration
     • Search indexing configuration
     • Authentication, data sources, or security policies
   • Permissions are focused solely on custom actions management.

Whether Action Moderator can also create new custom actions is flexible; we could see two patterns being useful:

• Option A: Action Moderator can also create actions (superset of Action Creator for actions).
• Option B: Action Moderator manages and curates actions, while Action Creator remains the only role for initial creation.

Either model would be acceptable; the key requirement is the ability to edit and reassign any custom action without needing full Admin.

Example Use Cases

1. Application Owner Support Team
   A central app owner or integration team is responsible for vetting and maintaining all custom actions that touch a specific system (e.g., CRM, ticketing). They need to:
   • Review and update actions created by business users.
   • Turn off problematic or deprecated actions.
   • Reassign actions when responsibility for that system changes.
2. Employee Offboarding
   When an employee who created many custom actions leaves:
   • An Action Moderator can quickly identify their actions and reassign them to a new owner.
   • The organization avoids orphaned actions and avoids over-reliance on Admins for routine changes.
3. Governance and Quality Control
   A center-of-excellence team wants to:
   • Periodically review all actions for adherence to naming, security, and data-handling guidelines.
   • Make small updates or corrections without needing to request Admin intervention or impersonate the original creator.

Benefits

• Improved governance and lifecycle management for custom actions.
• Reduced operational burden on Admins, who can focus on true administrative tasks.
• Safer delegation of responsibilities to power users or support teams without granting full Admin rights.
• Better continuity when employees change roles or leave, thanks to ownership reassignment.

Request

We are requesting:

1. Introduction of a new Action Moderator role with the capabilities described above (or a similar scoped role focused on custom actions management).
2. The ability for Admins to:
   • Assign the Action Moderator role to users or groups.
   • Use Action Moderator capabilities (edit any action, reassign owners) themselves, if that is not already possible.

If there is an existing way to achieve this pattern with current roles, or if there are design constraints we should consider, we would appreciate guidance as well. Otherwise, adding an Action Moderator role would give us a clear, secure way to scale adoption of custom actions across our user base.