[Full Release] Privacy for Newly-Created Image, Mesh, and Decal Assets

Hi Creators,

Managing your assets just got more powerful! Asset Privacy for Image, Mesh, and Decal assets is now fully released.. This release includes several improvements since the beta launched last year, including bulk sharing and bulk setting to “Open Use” of multiple assets:

  • All newly-created accounts and Groups will now have Asset Privacy enabled by default. You can still disable or enable privacy in your account settings or Group profile page.
  • Set any “Restricted” Image, Mesh, or Decal asset to “Open Use” from Creator Hub > Asset Configuration Page or in bulk using the revamped Asset Manager. If an asset is set to “Open Use”, it cannot be set to “Restricted”. See “Asset Privacy Overview” and the FAQ section for more details.
  • Share “Restricted” or “Open Use” assets with Friends and Groups from the asset’s Configure page > Permissions tab or bulk share multiple assets in Studio through the revamped Asset Manager.

This launch does not impact any existing accounts or assets, and does not impact the ability to distribute assets on the Creator Store or Avatar Marketplace.

Enabling/Disabling Asset Privacy

You can enable or disable Asset Privacy at any time for individual creator and group accounts.

When Asset Privacy is turned ON, newly-created Image, Mesh, and Decal assets are automatically set to “Restricted”, which means permissions will be checked when the asset is loaded into an experience or a user takes an action on the asset. See FAQ for exceptions. Asset Privacy will be turned on by default for new accounts.

If you decide to turn Asset Privacy OFF, newly-created Image, Mesh, and Decal assets will be set to “Open Use”, and cannot be set to “Restricted”.

Any existing “Restricted” assets will remain “Restricted” regardless of your account-wide Asset Privacy setting. You can choose to change “Restricted” Image, Mesh, or Decal assets to “Open Use” manually on the Creator Hub or in bulk in the revamped Asset Manager. Both “Open Use” and “Restricted” assets can be listed on the Creator Store. See the “Asset Privacy Overview” section below for details.

The table below summarizes what happens when you upload an asset with Asset Privacy either enabled or disabled:

Newly-Uploaded Asset Asset Privacy OFF Asset Privacy ON (now default for new accounts)
Image, Mesh, Decal Always set to “Open Use” Set to “Restricted” by default, but can be manually set to “Open Use”
Audio, Video, Package, Model, MeshPart Always set to “Restricted” by default, CANNOT be set to “Open Use” Always set to “Restricted” by default, CANNOT be set to “Open Use”

Note: Enabling or disabling Asset Privacy does not impact previously uploaded assets. If you create a Model, the contained dependencies (Images or Meshes) may still be set to “Open Use” if you uploaded them before toggling Asset Privacy ON.

Individual Accounts

Asset Privacy can be enabled/disabled in Creator Hub under Profile > Settings > Advanced.

Group Accounts

Only the group owner can enable/disable Asset Privacy. It can be enabled/disabled in Creator Hub under Collaboration > Group Profile.

Asset Privacy Overview

  • “Open Use” vs “Restricted”:

    • “Open Use” assets have no permission checks when loaded into an experience or on user actions like Studio insertion. If an asset is set to “Open Use”, it cannot be set to “Restricted”.
    • “Restricted” assets require permission checks when loaded or on user actions. This means that creators and experiences can only use the asset if the owner grants permission or if they acquired the content through Creator Store.
  • Uploading & Using “Restricted” Assets: All assets are always uploaded to a group or individual accounts. When using “Restricted” assets, every experience must have permission to load the asset. You automatically grant the experience permission to use an asset when you successfully insert the asset into one of the places in the experience in Studio. You can also explicitly share the asset with the experience in Creator Hub or through the revamped Asset Manager. Once an experience has permission to load an asset, the permission currently cannot be revoked.

  • Using in a Published Experience: “Restricted” assets can be used in a published experience. The experience must have permission to load the asset.

  • Sharing with Collaborators: You can share your assets with your friends and groups to give them access to your use assets. “Restricted” or “Open Use” assets can be directly shared with Friends or groups in bulk in Studio through the revamped Asset Manager or individually in the Permissions tab under the Asset Configuration Page in Creator Hub. Sharing “Open Use” assets helps your collaborators find the assets in Asset Manager.

  • Creator Store distribution: You can list your “Restricted” and “Open Use” assets on the Creator Store. “Open Use” assets can be used by any creator, regardless if they acquired the content through the Creator Store. If you plan to distribute priced Model assets, we recommend enabling Asset Privacy before you import your content so you can restrict access to your Models’ dependencies.

  • Avatar Marketplace Assets: Mesh and Image assets used in Avatar Marketplace assets must be set to “Open Use”. In Studio, when you create an Avatar Marketplace asset using “Restricted” Mesh and Image assets, you will be prompted to set the assets to “Open Use”.

Setting “Restricted” Mesh, Image and Decal Assets to “Open Use”

You can set any “Restricted” Mesh, Image or Decal asset to “Open Use” in the Asset Configuration Page on the Creator Hub or in bulk in Studio using the revamped Asset Manager. Model, Package, Audio, Video, and MeshPart assets cannot be set to “Open Use”.

Known Issues & Limitations

If you’re working with place files outside of Studio, you may run into permission errors when saving or publishing your place.

What’s Next

To further help facilitate collaboration, we plan to add permission pages in Studio to support managing the permissions of your assets. We are also working to improve the error messaging in Studio to help you better understand the error source and identify options to resolve.

Please let us know if you have any feedback, and help us improve the system - thank you!


FAQs

Click here to view

Does asset privacy and permission help fully protect my assets?

  • The goal of the system is to give you more control over usage of your assets across accounts. The system currently does not block your immediate collaborators from using your assets outside of your experiences. Collaborators include users who can edit your experience, or are members of the same group with permission to use assets uploaded to the group. However, outside creators that can’t edit your experiences or have access to your assets will not be able to use your “Restricted” assets in their experiences or directly list assets that use them in the Creator Store if they obtain the asset ID.

    In the future we will provide additional control for groups, enabling them to use the “Manage development item permissions” permission to restrict which members can use the group’s assets outside of the group’s experiences.

Can I make my existing Mesh, Images and Decals “Restricted”?

  • At this time, you cannot make your existing Mesh, Image and Decal assets “Restricted”. We are trying to strike a balance between giving control to creators who uploaded the assets and creators who are using the assets in their experiences and other assets (e.g., Models, Packages).

Why can’t I revoke access to other creators’ experiences?

  • We are trying to strike a balance between giving control to creators who uploaded the assets and creators who are using the assets in their experiences. We want to ensure those who depend on the assets can continue to use them without fear of their experiences breaking. If we do implement revocation in the future, we would like to assess what a reasonable solution would be to enable those who rely on the asset to find an alternative to minimize disruption to their experiences. As always, we are constantly improving the system and would love to hear your feedback.

Does privacy apply to all newly created Image, Mesh and Decal assets?

  • If you enable the Beta, all Decals will be “Restricted”. However there will still be some Image and Mesh assets that will be required to be “Open Use”:
    • Meshes and Images used for creating avatar assets are required to be set to “Open Use” when you create the avatar items. You will be prompted to change any “Restricted” assets to “Open Use”.
    • Image assets used for events/updates will become “Open Use” when the event becomes public.
    • Image assets used for Place thumbnails and icons, asset previews, passes, badges, subscriptions, talent hub, group profiles, and ads will automatically be set to “Open Use” when created.
67 Likes

This topic was automatically opened after 10 minutes.

Good update, but the fact that permissions can’t be revoked once an experience has access is kinda concerning. Doesn’t make sense, since you could give/revoke permissions with audios on the marketplace to experiences, but not with these?

11 Likes

Great security update. Thank you.

However, I have a suggestion: When it is set to Open Use, I would still like for it to be able to be changed back to Restricted. However, we can put restrictions on this, such as the switch from Open Use to Restricted will take 1 week or so to give time for any persons or groups have access to that asset to be able to plan ahead. They should also be notified that xyz asset is going from Open Use to Restricted.

does this prevent people from discovering random assets or only stop them from using it

You can already just archive assets so I see no reason as to why you can’t just switch them back to Restricted

Rebumping this message I sent on the old beta post a week ago.

16 Likes

jarvis. spawn a sinkhole underneath their computer
no response after a week is kind of insane especially since bribble is a big name

4 Likes

This would be a recipe for disaster:

  1. Commission for a very big game
  2. Revoke access after months & demand a huge sum to quickly restore access

Now on a smaller scale this will happen a lot, in bigger games not that often
But it’s a new risk especially when dealing with anonymous contractors

10 Likes

Not sure if this is intentional but when working on a game owned by someone else in team create and uploading an asset studio doesn’t automatically give that place access to the assets
image

Ok after further testing it looks like it gave the owner of the place permissions to use but I still had to manually give permission to that game and restart studio

I feel like this is on you as the commissioner if you are not having them provide you the raw files to upload yourself or at least having them upload it directly to your game’s group to avoid that scenario.

11 Likes

This should apply to archivals.

1 Like

this is a good step in the right direction but there’s a part of the asset “pipeline” that’s still completely unsecured, there are existing tools that rip assets from the client’s cache and all you need to do is play a game then run the tool to steal all images, meshes, videos, fonts, audios, translations, and more that were loaded during your playsession
code privacy could also be better. while decompilation is unavoidable maybe some sort of obfuscation could help? there are definitely performance concerns but hopefully something could be figured out

i mean inevitably the client has to download these assets at SOME point, there will always be a way to rip these.

the point isn’t rlly to make it impossible because that’s not realistic, it’s to make it harder because it’s like incredibly easy to rip assets right now

1 Like

im guessing assets would not load into their studio/game if the assets are set to restricted, so this update will fix that

This would be a recipe for disaster:

  1. Get commissioned for a very big game
  2. They don’t pay you and now you can’t revoke permissions so now they keep everything you made for free

Now on a smaller scale this will happen a lot, in bigger games not that often. But it’s a new risk especially when dealing with anonymous contractors

Was this not always a risk due to the option to archive meshes?

Even before this update, this has been a thing. Ideally you’ll get paid once you receive the assets normally. And vice versa, if a dev paid you for an asset and you decide not to give it.

the moral is to have mutual trust, maybe put them through a test at first to see what they’re like.

1 Like

All you’re doing is slowing down the performance of the code being obfuscated, not making it harder. When decompilers decompile your code it is ALREADY very hard to read because Roblox does not send the actual source to the client, but instead bytecode which lacks information about comments, original variable names, etc…

Adding on top of that, there is further no way for them to make it harder for someone to rip audio, images, etc… as even if you do encrypt the data in some way the client still needs to decrypt it and hold it somewhere in either RAM or GPU memory in order to actually use it, so that’s just another added step which worsens performance for zero gain.

1 Like