I have searched the existing issues and discussions.
Problem Description
Open WebUI currently lacks granular control over who can share workspace resources (models, knowledge bases, prompts, and tools) with groups, creating governance issues in large organizations. Any user who belongs to a group can automatically share any workspace resource they create with that entire group, with no way to prevent this behavior.
Examples of where this creates significant problems across all workspace resource types:
Universities: Students in a shared "Students" group can spam each other's interfaces by sharing personal models, uploading irrelevant knowledge bases, creating joke prompts, or publishing buggy tools
Large organizations: Employees can flood departmental groups with personal workspace items, making it difficult for colleagues to find legitimate shared resources
Multi-tenant environments: Users can clutter shared spaces with experimental or low-quality content that affects the entire group's productivity
The core issue affects all workspace resources equally - group membership serves dual purposes (access control vs. sharing permissions) but Open WebUI treats them as the same thing. There's no way to say "this user belongs to the group for access purposes, but cannot share [models/knowledge/prompts/tools] with the group."
Currently, this creates inconsistent governance where administrators must either:
Remove users from groups (breaking their legitimate access needs)
Accept interface pollution across all workspace resource types
Manually clean up shared resources after the fact
Desired Solution you'd like
Add granular a shareGroup style permission for each workspace resource type, allowing administrators to control sharing capabilities independently:
Flexible Control:
Administrators can enable prompt sharing while restricting model sharing
Different resource types can have different sharing policies based on organizational needs
Default: shareGroup: false for all workspace resources for standard users
User Experience:
Consistent sharing dialog behavior across all workspace resource types
Users see simplified "Private only" options for resources they cannot share with groups
Alternatives Considered
Automatically create groups in a very granular way so users can only share with a small subset of other users. This could become a nightmare to manage
Additional Context
No response
Originally created by @ricdikulous on GitHub (Jun 18, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/15098
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
### Problem Description
Open WebUI currently lacks granular control over who can share workspace resources (models, knowledge bases, prompts, and tools) with groups, creating governance issues in large organizations. Any user who belongs to a group can automatically share any workspace resource they create with that entire group, with no way to prevent this behavior.
Examples of where this creates significant problems across all workspace resource types:
- **Universities**: Students in a shared "Students" group can spam each other's interfaces by sharing personal models, uploading irrelevant knowledge bases, creating joke prompts, or publishing buggy tools
- **Large organizations**: Employees can flood departmental groups with personal workspace items, making it difficult for colleagues to find legitimate shared resources
- **Multi-tenant environments**: Users can clutter shared spaces with experimental or low-quality content that affects the entire group's productivity
The core issue affects all workspace resources equally - group membership serves dual purposes (access control vs. sharing permissions) but Open WebUI treats them as the same thing. There's no way to say "this user belongs to the group for access purposes, but cannot share [models/knowledge/prompts/tools] with the group."
Currently, this creates inconsistent governance where administrators must either:
- Remove users from groups (breaking their legitimate access needs)
- Accept interface pollution across all workspace resource types
- Manually clean up shared resources after the fact
### Desired Solution you'd like
Add granular a `shareGroup` style permission for each workspace resource type, allowing administrators to control sharing capabilities independently:
**Flexible Control:**
- Administrators can enable prompt sharing while restricting model sharing
- Different resource types can have different sharing policies based on organizational needs
- **Default**: `shareGroup: false` for all workspace resources for standard users
**User Experience:**
- Consistent sharing dialog behavior across all workspace resource types
- Users see simplified "Private only" options for resources they cannot share with groups
### Alternatives Considered
Automatically create groups in a very granular way so users can only share with a small subset of other users. This could become a nightmare to manage
### Additional Context
_No response_
You can disable public sharing for certain groups and also only give specific groups permissions to create workspace items (e.g. EditorGroup, StudentGroup)
<!-- gh-comment-id:2982920209 -->
@tjbck commented on GitHub (Jun 18, 2025):
You can disable public sharing for certain groups and also only give specific groups permissions to create workspace items (e.g. `EditorGroup`, `StudentGroup`)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @ricdikulous on GitHub (Jun 18, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/15098
Check Existing Issues
Problem Description
Open WebUI currently lacks granular control over who can share workspace resources (models, knowledge bases, prompts, and tools) with groups, creating governance issues in large organizations. Any user who belongs to a group can automatically share any workspace resource they create with that entire group, with no way to prevent this behavior.
Examples of where this creates significant problems across all workspace resource types:
The core issue affects all workspace resources equally - group membership serves dual purposes (access control vs. sharing permissions) but Open WebUI treats them as the same thing. There's no way to say "this user belongs to the group for access purposes, but cannot share [models/knowledge/prompts/tools] with the group."
Currently, this creates inconsistent governance where administrators must either:
Desired Solution you'd like
Add granular a
shareGroupstyle permission for each workspace resource type, allowing administrators to control sharing capabilities independently:Flexible Control:
shareGroup: falsefor all workspace resources for standard usersUser Experience:
Alternatives Considered
Automatically create groups in a very granular way so users can only share with a small subset of other users. This could become a nightmare to manage
Additional Context
No response
@tjbck commented on GitHub (Jun 18, 2025):
You can disable public sharing for certain groups and also only give specific groups permissions to create workspace items (e.g.
EditorGroup,StudentGroup)