From ffe829fdf94828af7313cc1d9327a30531b3afb3 Mon Sep 17 00:00:00 2001
From: Omri Rosner <omri.rosner@elastic.co>
Date: Thu, 28 May 2026 17:15:39 +0300
Subject: [PATCH 1/2] [Workflows] Move managed workflow privilege section

---
 .../workflows_management/server/features.ts   | 39 +++++++++++++------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/src/platform/plugins/shared/workflows_management/server/features.ts b/src/platform/plugins/shared/workflows_management/server/features.ts
index e94c9f8da2511..4acbc98626f1e 100644
--- a/src/platform/plugins/shared/workflows_management/server/features.ts
+++ b/src/platform/plugins/shared/workflows_management/server/features.ts
@@ -64,17 +64,6 @@ export const WorkflowsManagementFeatureConfig: KibanaFeatureConfig = {
               api: [WorkflowsManagementApiActions.update],
               ui: [WorkflowsManagementUiActions.update],
             },
-            {
-              id: 'workflow_update_managed',
-              name: i18n.translate(
-                'platform.plugins.shared.workflows_management.featureRegistry.updateManagedWorkflowsSubFeaturePrivilege',
-                { defaultMessage: 'Update managed workflows' }
-              ),
-              includeIn: 'none',
-              savedObject: { all: [], read: [] },
-              api: [WorkflowsManagementApiActions.updateManaged],
-              ui: [],
-            },
             {
               id: 'workflow_delete',
               name: i18n.translate(
@@ -134,5 +123,33 @@ export const WorkflowsManagementFeatureConfig: KibanaFeatureConfig = {
         },
       ],
     },
+    {
+      name: i18n.translate(
+        'platform.plugins.shared.workflows_management.featureRegistry.managedWorkflowsSubFeatureName',
+        { defaultMessage: 'Managed Workflows Actions' }
+      ),
+      description: i18n.translate(
+        'platform.plugins.shared.workflows_management.featureRegistry.managedWorkflowsSubFeatureDescription',
+        { defaultMessage: 'Managed workflow actions need explicit assignment' }
+      ),
+      privilegeGroups: [
+        {
+          groupType: 'independent',
+          privileges: [
+            {
+              id: 'workflow_update_managed',
+              name: i18n.translate(
+                'platform.plugins.shared.workflows_management.featureRegistry.updateManagedWorkflowsSubFeaturePrivilege',
+                { defaultMessage: 'Update managed workflows' }
+              ),
+              includeIn: 'none',
+              savedObject: { all: [], read: [] },
+              api: [WorkflowsManagementApiActions.updateManaged],
+              ui: [],
+            },
+          ],
+        },
+      ],
+    },
   ],
 };

From dabf812fa0f1e8a8247febbb5cc4bd6dba21cd74 Mon Sep 17 00:00:00 2001
From: Omri Rosner <omri.rosner@elastic.co>
Date: Mon, 1 Jun 2026 11:25:58 +0300
Subject: [PATCH 2/2] [One Workflow] Align workflows privilege expectation

---
 .../platform/test/api_integration/apis/security/privileges.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/platform/test/api_integration/apis/security/privileges.ts b/x-pack/platform/test/api_integration/apis/security/privileges.ts
index 299595c0bb00c..aca5dd2f04ee5 100644
--- a/x-pack/platform/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/platform/test/api_integration/apis/security/privileges.ts
@@ -110,12 +110,12 @@ export default function ({ getService }: FtrProviderContext) {
         'minimal_read',
         'workflow_create',
         'workflow_update',
-        'workflow_update_managed',
         'workflow_delete',
         'workflow_execute',
         'workflow_read',
         'workflow_execution_read',
         'workflow_execution_cancel',
+        'workflow_update_managed',
       ],
       searchInferenceEndpoints: ['all', 'read', 'minimal_all', 'minimal_read'],
       fleetv2: [