Skip to main content
Give a team the Manage workflows permission on a team role, so it only applies to the workflows that team owns. Set the owner from the Owned by control at the top of the workflow editor (it reads No team until you set one), or from the Advanced settings panel. Once a workflow has an owning team, only members of an owning team with the permission, or anyone who holds it account-wide, can edit, enable, disable, or delete it. Manage workflows is in the Standard role by default, so out of the box everyone can manage every workflow. You’ll need to remove it from Standard before ownership restricts anything.

​
Workflows that run on private incidents

Setting a workflow to run on private incidents needs a second permission, Manage workflows that run on private incidents, on top of Manage workflows. This can be granted through a team role, so a team can manage workflows that run on their own private incidents. A team-role holder needs it for every one of the workflow’s owning teams.
Running a workflow on all private incidents (not just an owning team’s) always requires Manage workflows that run on private incidents account-wide, since it reaches incidents no team has been given access to. Running on private escalations is likewise account-level only, and a team role never grants it.
See Team roles for the full setup, Workflows for more on ownership, and Workflows on private incidents for the per-workflow options.

​
FAQs

Reassigning ownership always requires the Manage workflows permission granted account-wide. A team can manage a workflow they own, but they can’t hand it to another team or remove their own team from it.
They can be managed by anyone who holds Manage workflows account-wide. Until you remove it from your base roles (typically Standard), that’s everyone.
Yes. You can assign multiple owning teams, and a member of any one of them (with the permission granted to that team) can manage the workflow.
Yes. Anyone who holds Manage workflows account-wide can manage any workflow, regardless of which team owns it.
Yes, if they hold the Manage workflows that run on private incidents permission for the workflow’s owning team(s). They can then set the workflow to run on Private incidents for owning teams, the private incidents those teams can access. To set a workflow to run on all private incidents requires the permission account-wide.
You need the Manage workflows that run on private incidents permission for every owning team (or account-wide). On a workflow owned by teams A and B, holding it for only A isn’t enough. This is stricter than Manage workflows itself, where holding it for any one owning team is sufficient, because the workflow can run on the private incidents of any owning team, so whoever sets the scope needs authority over all of them.