fix: some bugs

app/api/v1/agents/[id]/route.ts

@@ -42,6 +42,7 @@ export const DELETE = withApiKey(
             if (access === "forbidden") return NextResponse.json({error: "Forbidden"}, {status: 403});
             if (access === "not_found") return NextResponse.json({error: "Not found"}, {status: 404});
 
+
             const agent = await getAgent(id, {
                 includeDatabases: false,
                 includeOrganizations: true,
@@ -51,6 +52,16 @@ export const DELETE = withApiKey(
 
             const organizationIds = agent.organizations.map(org => org.organizationId)
 
+            const canDeleteGlobalAgent =
+                ctx.user.permissions.isAdmin || ctx.user.permissions.isSuperAdmin;
+
+            if (!agent.organizationId && !canDeleteGlobalAgent) {
+                return NextResponse.json(
+                    { error: "Forbidden" },
+                    { status: 403 }
+                );
+            }
+
             await deleteAgentService({
                 agentId: agent.id,
                 organizationId: agent.organizationId ?? undefined,

app/api/v1/agents/route.ts

@@ -69,6 +69,16 @@ export const POST = withApiKey(
           );
         }
 
+        const canCreateGlobalAgent =
+            ctx.user.permissions.isAdmin || ctx.user.permissions.isSuperAdmin;
+
+        if (!organizationId && !canCreateGlobalAgent) {
+          return NextResponse.json(
+              { error: "Forbidden" },
+              { status: 403 }
+          );
+        }
+
         const createdAgent = await createAgentService({
           organizationId,
           data: {