AI Catalog: Display user attribution in catalog UI for agents and flows

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Work on this issue
• Close this issue

Summary

While audit events now track CRUD operations on AI Catalog items back to individual users (resolved in #577745), the catalog UI does not display user attribution information to help consumers understand who created or last modified agents and flows.

This creates two specific problems:

1. Public agents from private projects show no attribution: When a public agent is created on a private project, neither the listing page nor the detail page shows any attribution information
2. Inconsistency with CI/CD Catalog: The AI Catalog should follow the same pattern as the CI/CD Catalog, which displays who last edited an item (or who created it if there are no edits)

Related discussions

• Original security issue: #577745
• Discussion about UI attribution: https://gitlab.com/gitlab-org/gitlab/-/issues/577745#note_2933390393
• Comparison with CI/CD Catalog: https://gitlab.com/gitlab-org/gitlab/-/issues/577745#note_2933481217

Current behavior

For public agents from private projects:

Listing page (https://gitlab.com/explore/ai-catalog/agents):

• No organization or attribution visible

Detail page:

• No attribution information displayed

For all agents:

• No "created by" or "last updated by" information shown in the UI

Expected behavior

The AI Catalog should display user attribution similar to the CI/CD Catalog:

• Show who last edited the agent/flow
• If no edits have been made, show who created it
• For public agents from private projects, ensure some level of attribution is visible (even if the project itself is private)

Proposal

Display user attribution in the catalog UI following the CI/CD Catalog pattern. This should:

1. Help consumers evaluate the quality and trustworthiness of catalog items
2. Provide consistency across GitLab's catalog experiences
3. Ensure public items have visible attribution even when created from private projects

Notes

• Audit events already track all CRUD operations back to individual users for compliance/security purposes
• This issue focuses specifically on the consumer-facing UI experience
• The project/organization attribution work mentioned in https://gitlab.com/gitlab-org/gitlab/-/issues/577745#note_2894371332 has been completed