Use realm-qualified id as ownership fallback instead of username alone

[meghanmurphy1]

Summary

This PR:

• Prefer profile_uid for Agent Builder ownership; when missing, use a realm-qualified id (realm + username) instead of username alone
• Stop username-only owner matching in access checks and list filters so same-username users in different realms cannot read/update/delete each other’s private agents

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[kibanamachine]

💔 Build Failed

• Buildkite Build
• Commit: f2766d1
• Build duration: 89 mins

Failed CI Steps

• FTR Configs #4
• FTR Configs #61
• FTR Configs #165
• Scout Lane #1 - stateful-classic / default
• Scout Lane #10 - stateful-classic / default
• Scout Lane #16 - stateful-classic / agent_builder
• Scout Lane #16 - stateful-classic / agent_builder
• Scout Lane #23 - serverless-search / agent_builder
• Scout Lane #23 - serverless-search / agent_builder

Test Failures

• [job] [logs] FTR Configs #4 / endpoint "before all" hook in "endpoint"
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - continues conversation for repeated Slack origin
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - continues conversation for repeated Slack origin
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - returns the existing execution for a replayed idempotency key
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - returns the existing execution for a replayed idempotency key
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - schedules a single execution for concurrent duplicate deliveries
• [job] [logs] Scout Lane #23 - serverless-search / agent_builder / local-serverless-search - Agent Builder - converse callback API - schedules a single execution for concurrent duplicate deliveries
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - continues conversation for repeated Slack origin
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - continues conversation for repeated Slack origin
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - returns the existing execution for a replayed idempotency key
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - returns the existing execution for a replayed idempotency key
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - schedules a single execution for concurrent duplicate deliveries
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder - converse callback API - schedules a single execution for concurrent duplicate deliveries
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder — SML internal API - POST /internal/agent_builder/sml/_attach attaches entry and persists attachment refs
• [job] [logs] Scout Lane #16 - stateful-classic / agent_builder / local-stateful-classic - Agent Builder — SML internal API - POST /internal/agent_builder/sml/_attach attaches entry and persists attachment refs
• [job] [logs] Scout Lane #1 - stateful-classic / default / local-stateful-classic - Discover tabs - sharing - can share one unsaved tab from a persisted session
• [job] [logs] Scout Lane #10 - stateful-classic / default / local-stateful-classic - Entity attachment cases – flyout add-to-case actions and Entities accordion - Entities accordion renders when entity attachments were added via API
• [job] [logs] Scout Lane #10 - stateful-classic / default / local-stateful-classic - Entity attachment cases – flyout add-to-case actions and Entities accordion - renders no Entities accordion when a case has no entity attachments
• [job] [logs] FTR Configs #165 / maps app "after all" hook in "maps app"
• [job] [logs] FTR Configs #165 / maps app maps loaded from sample data "after all" hook in "maps loaded from sample data"
• [job] [logs] FTR Configs #165 / maps app maps loaded from sample data ecommerce "after all" hook for "should load layers"
• [job] [logs] FTR Configs #165 / maps app maps loaded from sample data ecommerce "before all" hook for "should load layers"

Metrics [docs]

✅ unchanged

History