- **Only the owner gives an agent `produce`, and a delegation the owner did not make ends for good (#5258).** `produce` pushes a Dashboard's data, so granting it to an agent is now owner-only like `write`: anyone else gets 403 (CLI exit 4), and the Access form offers an agent only `read` unless you own the page. Workspace admins still grant an agent `read` and still revoke any grant. Migration `20261109132621_agent_delegation_owner_only` retires every stored agent `write` or `produce` grant the page's owner did not issue, and triggers retire one when it is stored by a non-owner, when the page changes owner, when its issuer leaves the owning crew, or when the owning crew is deleted; members of a deleted crew no longer count as the owner for agent delegation or agent runs (other owner checks: #5259). Each retirement writes a `page.agent_grant.retired_not_owner` audit entry, and the grants list shows the reason. A retired delegation stays retired if its issuer later owns the page; the owner issues a new grant.