Thank you for the feedback. Asset privacy & permissions is focused on reducing unauthorized access to your meshes and images. It is not meant to be a DRM solution. If another creator gets access to one of your private Mesh or Image’s asset ID, they will not be able to insert it into their experience.
If a collaborator can edit your experience then they will have some access to the asset. If they are editing your experience and create a model instance that uses the restricted Mesh or Image, they will be able to save that Model as an asset into their account (i.e. that Model will appear in the revamped Asset Manager). However, they will not be able to list that Model on the Creator Store. Also, when they load the model the restricted Mesh or Image asset should not load unless that asset was shared with them (they have access to the asset in the revamped Asset Manager).
The auto-sharing of the Mesh or Image asset will happen if you insert your uploaded asset into a collaborator’s experience (not your experience).
This is the initial balance we are trying to strike between giving control to asset creators and enabling flexible workflows for collaborators. We are always working to improve the system, and can explore adding additional restrictions in the future. We’d just want to do it in a way that doesn’t severely impact usability during collaboration.