All Hands Mode: let org members send follow-up messages to service account automation conversations #1090

Summary

Add All Hands Mode, an on/off setting for automations that run as a service account. When on, any member of the organization can send follow-up messages to the conversation the automation created. Presence, queued messages, per-message attribution and an audit log make shared steering safe.

User Problem

An automation that runs as a service account creates a conversation that nobody owns. If a teammate wants to continue it, they have to start a new conversation and lose the context. When several people do get involved, there is no record of who opened the conversation or who sent which instruction. Teams need a way to let colleagues take over an automation's conversation, with clear visibility into who is involved and a reliable audit trail.

Scenarios

• A nightly triage automation posts its findings. An on-call engineer takes over the conversation and tells the agent to open a PR for one finding, without re-explaining the context.
• Two teammates open the same conversation. Each sees the other is there, and when they send messages at the same time, the messages are queued instead of colliding.
• A security-sensitive automation stays view-only, with All Hands Mode turned off.
• An admin reviews a conversation after the fact and needs to know who opened it, who sent each instruction, and when.

I Can...

Setup

• I can turn All Hands Mode on or off when I configure an automation to run as a service account. The setting is not shown for automations that don't run as a service account.
• I can see the current setting on the automation and change it later.
• All Hands Mode is off by default. Existing automations keep their current behavior.
• I can see a short notice next to the toggle: "Anyone in your organization can send messages that run with this service account's secrets."

All Hands Mode on

• I can send a follow-up message to the conversation as any member of the organization.
• I can trust that follow-ups run with the conversation's attached Agent Profile and the service account's secrets. They never use my personal profile or secrets.
• I can see the names of everyone who currently has the conversation open.
• I can send a message while another user's message is still being processed. My message is queued and runs in order. I can see that it is queued and its position in the queue.

Attribution and audit log

• I can see on every user message in the trajectory who sent it. The original automation prompt is attributed to the automation or service account.
• I can view an audit log for the conversation that records each user's name and ID with a timestamp for each of these events:
  • Opened: the user opened the conversation
  • Message sent: the user submitted a message
  • Message started: the queued message began running (so queue delay is visible)
• I can match audit log timestamps to the corresponding events in the final trajectory, for example through a shared message or event ID.
• I can see the audit log after the conversation ends, and I can see it only if I'm an admin.

All Hands Mode off

• I can open the conversation and read the full trajectory.
• I can see a read-only state with a disabled message input and a short explanation.
• Opening the conversation is still recorded in the audit log. It isn't limited to conversations where All Hands Mode is on.

Why It Matters

• It turns automation output into a starting point. Teams can steer a run in place instead of rebuilding context.
• Queueing, presence and attribution make shared steering safe. Instructions don't collide, and everyone can see who is involved.
• The audit log gives admins a defensible record of who used a service account's secrets, which makes it practical to enable the feature in security-conscious organizations.

This issue was created by an AI agent (OpenHands) on behalf of the user.