diff --git a/backend/open_webui/routers/models.py b/backend/open_webui/routers/models.py
index 5a56e11b6..76ed48d97 100644
--- a/backend/open_webui/routers/models.py
+++ b/backend/open_webui/routers/models.py
@@ -196,6 +196,14 @@ async def create_new_model(
         )
 
     else:
+        form_data.access_grants = filter_allowed_access_grants(
+            request.app.state.config.USER_PERMISSIONS,
+            user.id,
+            user.role,
+            form_data.access_grants,
+            'sharing.public_models',
+        )
+
         model = Models.insert_new_model(form_data, user.id, db=db)
         if model:
             return model
@@ -460,6 +468,7 @@ async def toggle_model_by_id(id: str, user=Depends(get_verified_user), db: Sessi
 
 @router.post('/model/update', response_model=Optional[ModelModel])
 async def update_model_by_id(
+    request: Request,
     form_data: ModelForm,
     user=Depends(get_verified_user),
     db: Session = Depends(get_session),
@@ -487,6 +496,14 @@ async def update_model_by_id(
             detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
         )
 
+    form_data.access_grants = filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_models',
+    )
+
     model = Models.update_model_by_id(form_data.id, ModelForm(**form_data.model_dump()), db=db)
     return model
 
diff --git a/backend/open_webui/routers/notes.py b/backend/open_webui/routers/notes.py
index 705d86e1c..0eec88a25 100644
--- a/backend/open_webui/routers/notes.py
+++ b/backend/open_webui/routers/notes.py
@@ -175,6 +175,15 @@ async def create_new_note(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
+    form_data.access_grants = filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_notes',
+        db=db,
+    )
+
     try:
         note = Notes.insert_new_note(user.id, form_data, db=db)
         return note
diff --git a/backend/open_webui/routers/prompts.py b/backend/open_webui/routers/prompts.py
index e4af8bb51..3b579c289 100644
--- a/backend/open_webui/routers/prompts.py
+++ b/backend/open_webui/routers/prompts.py
@@ -168,6 +168,14 @@ async def create_new_prompt(
             detail=ERROR_MESSAGES.UNAUTHORIZED,
         )
 
+    form_data.access_grants = filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_prompts',
+    )
+
     prompt = Prompts.get_prompt_by_command(form_data.command, db=db)
     if prompt is None:
         prompt = Prompts.insert_new_prompt(user.id, form_data, db=db)
@@ -275,6 +283,7 @@ async def get_prompt_by_id(prompt_id: str, user=Depends(get_verified_user), db:
 
 @router.post('/id/{prompt_id}/update', response_model=Optional[PromptModel])
 async def update_prompt_by_id(
+    request: Request,
     prompt_id: str,
     form_data: PromptForm,
     user=Depends(get_verified_user),
@@ -314,6 +323,14 @@ async def update_prompt_by_id(
                 detail=f"Command '/{form_data.command}' is already in use by another prompt",
             )
 
+    form_data.access_grants = filter_allowed_access_grants(
+        request.app.state.config.USER_PERMISSIONS,
+        user.id,
+        user.role,
+        form_data.access_grants,
+        'sharing.public_prompts',
+    )
+
     # Use the ID from the found prompt
     updated_prompt = Prompts.update_prompt_by_id(prompt.id, form_data, user.id, db=db)
     if updated_prompt:
diff --git a/backend/open_webui/routers/tools.py b/backend/open_webui/routers/tools.py
index 45897cd74..195a4eec3 100644
--- a/backend/open_webui/routers/tools.py
+++ b/backend/open_webui/routers/tools.py
@@ -354,6 +354,14 @@ async def create_new_tools(
     tools = Tools.get_tool_by_id(form_data.id, db=db)
     if tools is None:
         try:
+            form_data.access_grants = filter_allowed_access_grants(
+                request.app.state.config.USER_PERMISSIONS,
+                user.id,
+                user.role,
+                form_data.access_grants,
+                'sharing.public_tools',
+            )
+
             form_data.content = replace_imports(form_data.content)
             tool_module, frontmatter = load_tool_module_by_id(form_data.id, content=form_data.content)
             form_data.meta.manifest = frontmatter
@@ -481,6 +489,14 @@ async def update_tools_by_id(
 
         specs = get_tool_specs(TOOLS[id])
 
+        form_data.access_grants = filter_allowed_access_grants(
+            request.app.state.config.USER_PERMISSIONS,
+            user.id,
+            user.role,
+            form_data.access_grants,
+            'sharing.public_tools',
+        )
+
         updated = {
             **form_data.model_dump(exclude={'id'}),
             'specs': specs,