The employee account is set to 'visible only to me', but in the digital human list, other accounts can still see it. As shown in the figure, it keeps loading — so it should not appear in the digital employee list on the left.

[yangcanlaigit]

Pre-checks

• I have searched existing issues and this is not a duplicate.

Deployment Method

Docker

Steps to Reproduce

The employee account is set to 'visible only to me', but in the digital human list, other accounts can still see it. As shown in the figure, it keeps loading — so it should not appear in the digital employee list on the left.

Expected vs Actual Behavior

The employee account is set to 'visible only to me', but in the digital human list, other accounts can still see it. As shown in the figure, it keeps loading — so it should not appear in the digital employee list on the left.

Logs / Screenshots

The employee account is set to 'visible only to me', but in the digital human list, other accounts can still see it. As shown in the figure, it keeps loading — so it should not appear in the digital employee list on the left.

[Clawiee]

Thank you for reporting this bug! This is a visibility/permission filtering issue.

Analysis

Based on the description, when a digital employee (账号) is set to "visible only to me" (仅对自己可见), other users can still see it in the left sidebar digital employee list. The screenshot shows the account appears but then keeps loading (which indicates a permission/access check failure on the backend).

Root Cause

Looking at backend/app/api/agents.py, the list_agents endpoint should filter agents based on:

1. Agents the current user created
2. Agents the current user has permission to (via AgentPermission table)

When "visible only to me" is selected, the AgentPermission table should have scope_type = "user" with only the creator's ID in scope_ids. This should prevent other users from seeing this agent.

However, this issue suggests that either:

1. The agent list API is not properly filtering by visibility permissions
2. There's another API endpoint fetching agents for the sidebar that doesn't respect the same permissions
3. The frontend is not filtering based on permission data returned

Expected Behavior

• If an agent is set to "visible only to me" → Only the creator (and platform/org admins) should see it
• The agent should NOT appear in other users' left sidebar lists

Information Needed

Could you please confirm:

1. Is this a Native Agent or OpenClaw agent?
2. Which specific page/interface are you seeing this on? (Dashboard sidebar, relationships page, etc.)
3. Are both accounts (the one who created the agent and the one who can see it) in the same company/tenant?
4. Can you check the agent's permission settings in the agent detail page?

This will help us pinpoint exactly which API or component needs to be fixed.

---

🏷️ Labels: bug permissions visibility

[wisdomqin]

I haven't been able to reproduce this issue in our SaaS environment. Could you please try upgrading to the latest version and check again?

[yangcanlaigit]

"I've updated step by step to the latest version, but I'm still having this issue. Is it caused by the data in the database?"

我在我们的SaaS环境中无法重现这个问题。请您尝试升级到最新版本并再次检查。

[yangcanlaigit]

感谢您报告此错误！这是一个可见性/权限筛选问题。

分析

根据描述，当一个数字员工（账号）设置为“仅本人可见”时，其他用户仍然可以在左侧边栏的数字员工列表中看到它。截图显示该账号出现后一直处于加载状态（这表明后端权限/访问检查失败）。

根本原因

从这个角度来看backend/app/api/agents.py，该list_agents端点应该根据以下条件筛选代理：

1. 当前用户创建的代理
2. 当前用户有权访问的代理（通过AgentPermission表格）

如果选择“仅我可见”，则AgentPermission表格中应该scope_type = "user"只包含创建者的 ID scope_ids。这样可以防止其他用户看到此代理。

然而，这个问题表明：

1. 代理列表 API 未按可见性权限正确筛选。
2. 还有一个用于获取侧边栏代理的 API 端点，但它不遵循相同的权限设置。
3. 前端未根据返回的权限数据进行过滤。

预期行为

• 如果代理设置为“仅我可见”→则只有创建者（以及平台/组织管理员）才能看到它。
• 该代理不应出现在其他用户的左侧边栏列表中。

所需信息

请您确认一下：

1. 这是Native Agent还是OpenClaw Agent？
2. 您是在哪个页面/界面看到此问题的？（例如，仪表盘侧边栏、关系页面等）
3. 创建代理的账户和查看代理的账户是否属于同一公司/租户？
4. 请您在代理详情页面查看代理的权限设置。

这将有助于我们准确找出需要修复的 API 或组件。

🏷️ 标签：bug permissions visibility

It's an admin account. He can see this digital employee, but it keeps loading. It's already the latest version.

[yaojin3616]

Fixed in commit 927cac1: Enforce permission filter for all users including admins in list_agents (Fix for Issue #476).

Root cause: The agent listing API gave platform admins and org admins a shortcut that bypassed permission filtering, returning ALL agents in the tenant. This exposed "visible only to me" agents to admins.

Fix: All users, including admins, now go through the same permission logic: only agents they created, company-wide agents, or agents with explicit user-level permission are returned.