The Collection That Leaked
A finance team creates a Curated Collection called "Q3 Forecasts" and adds 12 workflows to it. The collection is shared with a group called Finance-Analysts. The workflows themselves are owned by a single power user and are stored in a private studio. The admin later discovers that members of Finance-Analysts can open the collection but cannot run the workflows inside it. Separately, a user who is not in Finance-Analysts reports that they can see and run one of the workflows because it was previously shared with them directly. The finance team wants collection members to be able to run everything in the collection, and wants the collection to be the single source of access.
1. Why can collection members see the collection but not run its workflows, and what must change?
Read the worked answer
A Curated Collection is a curation and discovery surface; sharing a collection with a group does not by itself grant execute permission on the workflows inside it. Execution permission comes from the workflow's own permissions (owner, shared-with users/groups, or studio permissions). The Finance-Analysts group was granted access to the collection but not to the underlying workflows, so members can browse the collection listing but are denied when they try to run.
To make the collection the single source of access, the admin should share the workflows themselves with the Finance-Analysts group with the appropriate permission (execute/run, and view if needed), or move the workflows into a studio whose permissions include that group. The collection then organizes and surfaces the workflows, while the workflow-level or studio-level permission grants the actual run rights.
2. How should the admin handle the user who can still run a workflow directly?
Read the worked answer
That user has a direct share on the workflow that predates or bypasses the collection. If the collection is to be the single source of access, the admin must audit the workflow's permissions and remove the individual direct share, then confirm the user's access comes only through group membership. Removing the direct share may revoke the user's access entirely if they are not in Finance-Analysts, which is the intended outcome. The admin should also check for other direct shares and for workflows that were shared broadly, since the same leak may exist on the other 11 workflows. A permission audit of the collection's contents, not just the one reported workflow, is warranted.