Suggestions is to add a requirement that the bookmarkname contains SHARED in order for it to be shared. Otherwise you cannot create any private bookmarks.
We also encourage only users that are part of a certain group to share (e.g. the ones the get a license, developers or similar). This encourages an introduction course for all users and once they passes they get to be a member of such a group.
Our rule look like this:
Rule 1: ReadBookmarkObject
Actions:
Read
Resource Filter:
App.Object_*
Conditions:
((!resource.App.stream.Empty() and resource.App.HasPrivilege("read") and resource.objectType = "bookmark" and resource.name like "SHARED*" and (resource.app.owner.group="AD_Group_that_is_allowed_to_share_bookmarks" or
resource.app.owner.roles="RootAdmin") ))
Context:
Only in Hub
