fix: add ownership checks to promote and delete agent routes

workspaces/augment/plugins/augment-backend/src/routes/agentRoutes.ts

@@ -289,7 +289,7 @@
 
         const isSubmitForReview =
           currentStage === 'draft' && nextStage === 'review';
         if (!isSubmitForReview) {
           const isAdmin = await ctx.checkIsAdmin(req);
           if (!isAdmin) {
             res.status(403).json({
@@ -299,6 +299,18 @@
             });
             return;
           }
+        } else {
+          const isAdmin = await ctx.checkIsAdmin(req);
+          if (
+            !isAdmin &&
+            existing?.createdBy &&
+            existing.createdBy !== userRef
+          ) {
+            res.status(403).json({
+              error: 'You can only submit your own agents for review.',
+            });
+            return;
+          }
         }
 
         const now = new Date().toISOString();
@@ -430,6 +442,55 @@
     ),
   );
 
+  // ---------------------------------------------------------------------------
+  // DELETE /agents/:agentId -- remove a draft agent's config entry
+  // Non-admin callers can only delete agents they created.
+  // ---------------------------------------------------------------------------
+  router.delete(
+    '/agents/:agentId',
+    withRoute(
+      'DELETE /agents/:agentId',
+      'Failed to delete agent',
+      async (req, res) => {
+        const agentId = decodeURIComponent(req.params.agentId);
+        const userRef = await ctx.getUserRef(req);
+        const configs = await loadChatAgentConfigs();
+        const existing = configs.find(c => c.agentId === agentId);
+
+        if (!existing) {
+          throw new InputError(`Agent "${agentId}" not found in config.`);
+        }
+
+        const stage = normalizeLifecycleStage(existing.lifecycleStage);
+        if (stage !== 'draft') {
+          throw new InputError(
+            `Only draft agents can be deleted. Agent "${agentId}" is in stage "${stage}".`,
+          );
+        }
+
+        const isAdmin = await ctx.checkIsAdmin(req);
+        if (!isAdmin && existing.createdBy && existing.createdBy !== userRef) {
+          res.status(403).json({
+            error: 'You can only delete your own agents.',
+          });
+          return;
+        }
+
+        const updated = configs.filter(c => c.agentId !== agentId);
+        await saveChatAgentConfigs(updated, userRef);
+        audit.log({
+          action: 'agent.delete',
+          actor: userRef,
+          target: agentId,
+          outcome: 'success',
+          sourceIp: AuditLogger.extractIp(req),
+        });
+        logger.info(`Draft agent "${agentId}" deleted by ${userRef}`);
+        res.json({ success: true, agentId });
+      },
+    ),
+  );
+
   // ---------------------------------------------------------------------------
   // PUT /agents/:agentId/publish -- shortcut: promote to production
   // ---------------------------------------------------------------------------

workspaces/augment/plugins/augment-backend/src/services/AuditLogger.ts

@@ -25,6 +25,7 @@ export type AuditAction =
   | 'tool.approval'
   | 'tool.lifecycle'
   | 'agent.lifecycle'
+  | 'agent.delete'
   | 'document.upload'
   | 'document.delete'
   | 'admin.login';

workspaces/augment/plugins/augment-common/report.api.md

@@ -257,6 +257,7 @@ export interface ChatAgent {
   agentRole?: AgentRole;
   avatarUrl?: string;
   createdAt?: string;
+  createdBy?: string;
   description?: string;
   framework?: string;
   id: string;
@@ -281,6 +282,7 @@ export interface ChatAgentConfig {
   agentId: string;
   avatarUrl?: string;
   conversationStarters?: string[];
+  createdBy?: string;
   description?: string;
   displayName?: string;
   featured: boolean;

workspaces/augment/plugins/augment-common/src/types/shared.ts

@@ -404,6 +404,8 @@ export interface ChatAgentConfig {
   greeting?: string;
   /** Suggested prompts shown on the agent card and below the input */
   conversationStarters?: string[];
+  /** User ref of who originally created this agent config entry */
+  createdBy?: string;
 }
 
 /**

workspaces/augment/plugins/augment/report.api.md

@@ -162,6 +162,7 @@ export interface AugmentApi {
   createVectorStore(
     config?: Record<string, unknown>,
   ): Promise<VectorStoreCreateResult>;
+  deleteAgentConfig(agentId: string): Promise<void>;
   deleteAdminConfig(key: AdminConfigKey): Promise<{
     deleted: boolean;
   }>;

workspaces/augment/plugins/augment/src/api/AugmentApi.ts

@@ -114,6 +114,11 @@ export interface AugmentApi {
     >,
   ): Promise<void>;
 
+  /**
+   * Delete a draft agent's configuration entry.
+   */
+  deleteAgentConfig(agentId: string): Promise<void>;
+
   /**
    * List tools with lifecycle overlay in a provider-agnostic format.
    */
@@ -807,6 +812,12 @@ export class AugmentApiClient implements AugmentApi {
     });
   }
 
+  async deleteAgentConfig(agentId: string): Promise<void> {
+    await this.fetchJson(`/agents/${encodeURIComponent(agentId)}`, {
+      method: 'DELETE',
+    });
+  }
+
   async listToolsWithLifecycle(options?: { published?: boolean }): Promise<
     (import('@red-hat-developer-hub/backstage-plugin-augment-common').KagentiToolSummary & {
       published?: boolean;