lael-labs/executor

.changeset/config.json+1−0

@@ -5,6 +5,7 @@ · 4 unmodified lines
5	"fixed": [	5	"fixed": [
6	[	6	[
7	"@executor-js/sdk",	7	"@executor-js/sdk",
		8	"@executor-js/product-access",
8	"@executor-js/codemode-core",	9	"@executor-js/codemode-core",
9	"@executor-js/runtime-quickjs",	10	"@executor-js/runtime-quickjs",
10	"@executor-js/execution",	11	"@executor-js/execution",

.changeset/product-access-split.md+21−0

@@ -0,0 +1,21 @@
	1	---
	2	"executor": minor
	3	---
	4
	5	Extract personal/organization access rules from the core SDK into the new
	6	`@executor-js/product-access` package. BREAKING for SDK embedders:
	7	`createExecutor` (Effect and Promise APIs alike) now REQUIRES
	8	`access: ExecutorAccess` — the product's decisions for row visibility and
	9	write partitions (`owners`), user-intent settings authorization
	10	(`settingsWrite`), view capabilities (`adminReads` / `storageWrites`), and
	11	effective tool-policy evaluation (`toolPolicy`). The former `orgWrites` and
	12	`platformView` options are removed; select a posture from
	13	`@executor-js/product-access` (`singleUserAccess()`,
	14	`workspaceServiceAccess()`, `memberAccessForRole(...)`,
	15	`requestBoundMemberAccess()`, `platformObserverAccess()`) or supply your own.
	16	Core keeps enforcing tenant isolation, the storage owner policy clamps, and
	17	approval mechanics; it no longer decides any product rule. Test helpers
	18	changed too: `makeTestConfig` and the workspace harness require `access`
	19	(postures in `@executor-js/product-access/testing`). No stored schema or data
	20	migration — persisted rows, tenants, owners, subjects and addresses are
	21	unchanged.

.github/workflows/pkg-pr-new.yml+1−0

@@ -149,6 +149,7 @@ jobs: · 148 unmodified lines
149	'./apps/cli/dist/executor'	149	'./apps/cli/dist/executor'
150	'./packages/core/storage-core'	150	'./packages/core/storage-core'
151	'./packages/core/sdk'	151	'./packages/core/sdk'
		152	'./packages/core/product-access'
152	'./packages/core/config'	153	'./packages/core/config'
153	'./packages/core/execution'	154	'./packages/core/execution'
154	'./packages/core/cli'	155	'./packages/core/cli'

README.md+12−4

@@ -139,10 +139,18 @@ Embed Executor with the TypeScript SDK (a Promise API; an Effect-native API is · 138 unmodified lines
139	also available):	139	also available):
140		140
141	```ts	141	```ts
142	import { createExecutor } from "@executor-js/sdk/promise";	142	import { workspaceServiceAccess } from "@executor-js/product-access";
143	import { openApiPlugin } from "@executor-js/plugin-openapi/promise";	143	import { createExecutor } from "@executor-js/sdk";
144		144	import { openApiPlugin } from "@executor-js/plugin-openapi";
145	const executor = await createExecutor({ plugins: [openApiPlugin()] });	145
		146	const executor = await createExecutor({
		147	plugins: [openApiPlugin()],
		148	onElicitation: "accept-all",
		149	// Product access decisions are REQUIRED and stated explicitly — the SDK
		150	// ships no default posture. `@executor-js/product-access` has the standard
		151	// ones (this is the subject-less single-workspace posture).
		152	access: workspaceServiceAccess(),
		153	});
146		154
147	// add an integration, create a connection, then list and call tools	155	// add an integration, create a connection, then list and call tools
148	const tools = await executor.tools.list({ integration: "inventory" });	156	const tools = await executor.tools.list({ integration: "inventory" });

apps/cloud/package.json+1−0

@@ -55,6 +55,7 @@ · 54 unmodified lines
55	"@executor-js/plugin-openapi": "workspace:*",	55	"@executor-js/plugin-openapi": "workspace:*",
56	"@executor-js/plugin-toolkits": "workspace:*",	56	"@executor-js/plugin-toolkits": "workspace:*",
57	"@executor-js/plugin-workos-vault": "workspace:*",	57	"@executor-js/plugin-workos-vault": "workspace:*",
		58	"@executor-js/product-access": "workspace:*",
58	"@executor-js/react": "workspace:*",	59	"@executor-js/react": "workspace:*",
59	"@executor-js/runtime-dynamic-worker": "workspace:*",	60	"@executor-js/runtime-dynamic-worker": "workspace:*",
60	"@executor-js/runtime-quickjs": "workspace:*",	61	"@executor-js/runtime-quickjs": "workspace:*",

apps/cloud/src/admin/admin-users-api.ts+1−1

@@ -17,7 +17,7 @@ · 16 unmodified lines
17	// acting member, and this plane deliberately serves the whole tenant.	17	// acting member, and this plane deliberately serves the whole tenant.
18	//	18	//
19	// The executor is built by `makePlatformExecutor` — `{ tenant, subject:	19	// The executor is built by `makePlatformExecutor` — `{ tenant, subject:
20	// undefined, platformView: true }` — so the reads are tenant-wide and read-only	20	// undefined, access: platformObserverAccess() }` — so the reads are tenant-wide and read-only
21	// by storage policy, and no `subject` row is minted for the caller.	21	// by storage policy, and no `subject` row is minted for the caller.
22	//	22	//
23	// Cross-tenant isolation is structural, not a check in this file: the tenant is	23	// Cross-tenant isolation is structural, not a check in this file: the tenant is

apps/cloud/src/auth/workos-auth-provider.ts+1−1

@@ -174,7 +174,7 @@ const resolveJwtPrincipal = (token: string, jwt: JwtBearerConfig) => · 173 unmodified lines
174	* `subject: null` + the read-only tenant reach rather than inventing a subject.	174	* `subject: null` + the read-only tenant reach rather than inventing a subject.
175	*	175	*
176	* The `/admin/*` mount turns this into an executor with `{ tenant:	176	* The `/admin/*` mount turns this into an executor with `{ tenant:
177	* organizationId, subject: undefined, platformView: true }`.	177	* organizationId, subject: undefined, access: platformObserverAccess() }`.
178	*/	178	*/
179	export interface PlatformAuth {	179	export interface PlatformAuth {
180	readonly kind: "platform";	180	readonly kind: "platform";

apps/cloud/src/mcp-session.e2e.node.test.ts+2−0

 import executorConfig from "../executor.config";
 import { DbService } from "./db/db";
 import { createDrizzleFumaDb } from "./db/fuma";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Test-only plugin: exposes one in-memory tool that elicits once. Lets the
       plugins,
       httpClientLayer: FetchHttpClient.layer,
       onElicitation: "accept-all",
+      access: testAccess.member(),
     });
   });

apps/cloud/src/mcp/session-durable-object.ts+2−1

 } from "@executor-js/host-mcp/tool-server";
 import { buildResumeApprovalUrl } from "@executor-js/host-mcp/browser-approval";
 import { artifactUrlFor } from "@executor-js/host-mcp/create-artifact";
+import { requestBoundMemberAccess } from "@executor-js/product-access";
 import { makeAssetsShellHtmlLoader } from "@executor-js/mcp-apps-shell/worker";
 import { smokeRenderArtifact } from "@executor-js/mcp-apps-shell/smoke-render";
 import {
         sessionMeta.organizationName,
         {
           mcpResource: sessionMeta.resource,
-          orgWrites: "request",
+          access: requestBoundMemberAccess(),
         },
       ).pipe(
         // The metered stack tracks each execution to Autumn. It requires

apps/cloud/src/observability/oauth-callback-telemetry.test.ts+2−1

 import { makeTestConfig } from "@executor-js/sdk/testing";
 import { UrlRedactingSpanProcessor } from "./redact-span-urls";
+import { testAccess } from "@executor-js/product-access/testing";
 // Synthetic placeholders — never a real authorization code or CSRF state.
 const CODE = "synthetic-authorization-code-9f2c";
   it.effect("exports no span attribute containing the authorization code or state", () =>
     Effect.gen(function* () {
       const { exporter, provider, tracerLayer } = makeTracing();
-      const executor = yield* createExecutor(makeTestConfig({}));
+      const executor = yield* createExecutor(makeTestConfig({ access: testAccess.member() }));
       const web = yield* Effect.acquireRelease(
         Effect.sync(() =>

apps/host-cloudflare/package.json+1−0

@@ -30,6 +30,7 @@ · 29 unmodified lines
30	"@executor-js/plugin-openapi": "workspace:*",	30	"@executor-js/plugin-openapi": "workspace:*",
31	"@executor-js/plugin-provider-service-split": "workspace:*",	31	"@executor-js/plugin-provider-service-split": "workspace:*",
32	"@executor-js/plugin-toolkits": "workspace:*",	32	"@executor-js/plugin-toolkits": "workspace:*",
		33	"@executor-js/product-access": "workspace:*",
33	"@executor-js/react": "workspace:*",	34	"@executor-js/react": "workspace:*",
34	"@executor-js/runtime-dynamic-worker": "workspace:*",	35	"@executor-js/runtime-dynamic-worker": "workspace:*",
35	"@executor-js/runtime-quickjs": "workspace:*",	36	"@executor-js/runtime-quickjs": "workspace:*",

apps/host-cloudflare/src/mcp/session-durable-object.ts+2−1

 import { makeAssetsShellHtmlLoader } from "@executor-js/mcp-apps-shell/worker";
 import { smokeRenderArtifact } from "@executor-js/mcp-apps-shell/smoke-render";
 import type { ExecutorDbHandle } from "@executor-js/api/server";
+import { requestBoundMemberAccess } from "@executor-js/product-access";
 import {
   McpAgentSessionDOBase,
   type BuiltMcpServer,
         sessionMeta.userId,
         sessionMeta.organizationId,
         sessionMeta.organizationName,
-        { mcpResource: sessionMeta.resource, orgWrites: "request" },
+        { mcpResource: sessionMeta.resource, access: requestBoundMemberAccess() },
       ).pipe(Effect.provide(makeCloudflareExecutionStackLayer(config, dbHandle)));
       // Browser elicitation mode (the base owns the approval store + the HTTP
       // approval RPCs): a gated execution pauses and returns an approvalUrl into

apps/host-selfhost/package.json+1−0

@@ -35,6 +35,7 @@ · 34 unmodified lines
35	"@executor-js/plugin-openapi": "workspace:*",	35	"@executor-js/plugin-openapi": "workspace:*",
36	"@executor-js/plugin-provider-service-split": "workspace:*",	36	"@executor-js/plugin-provider-service-split": "workspace:*",
37	"@executor-js/plugin-toolkits": "workspace:*",	37	"@executor-js/plugin-toolkits": "workspace:*",
		38	"@executor-js/product-access": "workspace:*",
38	"@executor-js/react": "workspace:*",	39	"@executor-js/react": "workspace:*",
39	"@executor-js/runtime-quickjs": "workspace:*",	40	"@executor-js/runtime-quickjs": "workspace:*",
40	"@executor-js/sdk": "workspace:*",	41	"@executor-js/sdk": "workspace:*",

apps/host-selfhost/src/integrations-mcp.test.ts+4−3

 import { mintInviteCode } from "./testing/mint-invite";
 import { SelfHostScopedExecutorSeams } from "./execution";
 import type { SelfHostPlugins } from "./plugins";
+import { memberAccess } from "@executor-js/product-access";
 // The self-host scoped-executor seams (DbProvider over the long-lived SelfHostDb,
 // fresh per-request plugins, host config) over the shared `makeScopedExecutor`,
   organizationId: string,
   organizationName: string,
 ) =>
-  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName).pipe(
+  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName, {
-    Effect.provide(SelfHostScopedExecutorSeams),
+    access: memberAccess("allowed"),
-  );
+  }).pipe(Effect.provide(SelfHostScopedExecutorSeams));
 // End-to-end: an org-owned connection's tools are reachable from a user's MCP
 // `execute` sandbox.

apps/host-selfhost/src/integrations.test.ts+4−3

 import { createSelfHostDb, SelfHostDb } from "./db/self-host-db";
 import { SelfHostScopedExecutorSeams } from "./execution";
 import type { SelfHostPlugins } from "./plugins";
+import { memberAccess } from "@executor-js/product-access";
 // The self-host scoped-executor seams (DbProvider over the long-lived SelfHostDb,
 // fresh per-request plugins, host config) over the shared `makeScopedExecutor`,
   organizationId: string,
   organizationName: string,
 ) =>
-  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName).pipe(
+  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName, {
-    Effect.provide(SelfHostScopedExecutorSeams),
+    access: memberAccess("allowed"),
-  );
+  }).pipe(Effect.provide(SelfHostScopedExecutorSeams));
 const dataDir = mkdtempSync(join(tmpdir(), "eh-src-"));
 process.env.EXECUTOR_DATA_DIR = dataDir;

apps/host-selfhost/src/secrets-integration.test.ts+4−3

 import { createSelfHostDb, SelfHostDb } from "./db/self-host-db";
 import { SelfHostScopedExecutorSeams } from "./execution";
 import type { SelfHostPlugins } from "./plugins";
+import { memberAccess } from "@executor-js/product-access";
 // In v2 a connection IS the credential: its inline `value` is written through the
 // default writable provider — here the encrypted-secrets provider, which stores
   organizationId: string,
   organizationName: string,
 ) =>
-  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName).pipe(
+  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, organizationName, {
-    Effect.provide(SelfHostScopedExecutorSeams),
+    access: memberAccess("allowed"),
-  );
+  }).pipe(Effect.provide(SelfHostScopedExecutorSeams));
 let dbLayer!: Layer.Layer<SelfHostDb>;
 let dbHandle: Awaited<ReturnType<typeof createSelfHostDb>> | undefined;

apps/host-selfhost/src/subject-sightings.test.ts+4−3

 import { createSelfHostDb, SelfHostDb } from "./db/self-host-db";
 import { SelfHostScopedExecutorSeams } from "./execution";
 import type { SelfHostPlugins } from "./plugins";
+import { memberAccess } from "@executor-js/product-access";
 // The `subject` table is populated at the request seam: `makeScopedExecutor` is
 // what every HTTP request and MCP session on every host passes through, so
 // the point is that the production wiring reaches the writer at all.
 const createScopedExecutor = (accountId: string, organizationId: string) =>
-  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, "Default").pipe(
+  makeScopedExecutor<SelfHostPlugins>(accountId, organizationId, "Default", {
-    Effect.provide(SelfHostScopedExecutorSeams),
+    access: memberAccess("allowed"),
-  );
+  }).pipe(Effect.provide(SelfHostScopedExecutorSeams));
 const dataDir = mkdtempSync(join(tmpdir(), "eh-subj-"));
 process.env.EXECUTOR_DATA_DIR = dataDir;

apps/local/package.json+1−0

@@ -41,6 +41,7 @@ · 40 unmodified lines
41	"@executor-js/plugin-openapi": "workspace:*",	41	"@executor-js/plugin-openapi": "workspace:*",
42	"@executor-js/plugin-provider-service-split": "workspace:*",	42	"@executor-js/plugin-provider-service-split": "workspace:*",
43	"@executor-js/plugin-toolkits": "workspace:*",	43	"@executor-js/plugin-toolkits": "workspace:*",
		44	"@executor-js/product-access": "workspace:*",
44	"@executor-js/react": "workspace:*",	45	"@executor-js/react": "workspace:*",
45	"@executor-js/runtime-quickjs": "workspace:*",	46	"@executor-js/runtime-quickjs": "workspace:*",
46	"@executor-js/sdk": "workspace:*",	47	"@executor-js/sdk": "workspace:*",

apps/local/src/auth-tool-failures.test.ts+2−0

   createExecutor,
 } from "@executor-js/sdk";
 import { memoryCredentialsPlugin } from "@executor-js/sdk/testing";
+import { testAccess } from "@executor-js/product-access/testing";
 import { ErrorCaptureLive } from "./observability";
 import { createSqliteFumaDb } from "./db/sqlite-fumadb";
       db: sqlite.db,
       plugins,
       onElicitation: "accept-all",
+      access: testAccess.member(),
     }),
   );

apps/local/src/db/legacy-bigint-boot.test.ts+12−4

 import { withQueryContext } from "@executor-js/fumadb/query";
 import { collectTables } from "@executor-js/api/server";
-import { runSqliteDataMigrations } from "@executor-js/sdk";
+import { runSqliteDataMigrations, type ExecutorOwnerPolicyContext } from "@executor-js/sdk";
 import { localDataMigrations } from "./data-migrations";
 import { createSqliteFumaDb } from "./sqlite-fumadb";
 const TENANT = "executor-workspace-1771";
 const SUBJECT = "local";
+// The fixture's inspection context: the local single-user binding's full
+// identity view, with its owner partitions stated explicitly — the owner
+// policy has no full-view default, and the seeded row is a `user` row.
+const FIXTURE_CONTEXT: ExecutorOwnerPolicyContext = {
+  tenant: TENANT,
+  subject: SUBJECT,
+  owners: ["user", "org"],
+};
 // Epoch millis, the shape an OAuth token expiry takes.
 const LEGACY_EXPIRES_AT = 1787321623456;
     await seedLegacyConnection(dbPath);
     const sqlite = await openDb(dbPath);
-    const scoped = withQueryContext(sqlite.db, { tenant: TENANT, subject: SUBJECT });
+    const scoped = withQueryContext(sqlite.db, FIXTURE_CONTEXT);
     // The reported symptom: not a wrong value, a throw — so the gateway lost
     // every saved integration at once.
     await expect(scoped.findMany("connection", {})).rejects.toThrow(/type number/);
     );
     expect(applied).toContain("2026-08-28-bigint-storage-class");
-    const scoped = withQueryContext(sqlite.db, { tenant: TENANT, subject: SUBJECT });
+    const scoped = withQueryContext(sqlite.db, FIXTURE_CONTEXT);
     const rows = await scoped.findMany("connection", {});
     expect(rows.map((row) => [row.name, Number(row.expires_at)])).toEqual([
       ["default", LEGACY_EXPIRES_AT],
     );
     expect(applied).not.toContain("2026-08-28-bigint-storage-class");
-    const scoped = withQueryContext(second.db, { tenant: TENANT, subject: SUBJECT });
+    const scoped = withQueryContext(second.db, FIXTURE_CONTEXT);
     const rows = await scoped.findMany("connection", {});
     expect(rows.map((row) => Number(row.expires_at))).toEqual([LEGACY_EXPIRES_AT]);
     await second.close();

apps/local/src/db/v1-v2-boot-drive.test.ts+2−0

   runSqliteDataMigrations,
 } from "@executor-js/sdk";
 import { memoryCredentialsPlugin } from "@executor-js/sdk/testing";
+import { testAccess } from "@executor-js/product-access/testing";
 import { openApiPlugin } from "@executor-js/plugin-openapi";
 import { serveOpenApiHttpApiTestServer } from "@executor-js/plugin-openapi/testing";
 import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
         memoryCredentialsPlugin(),
       ] as const,
       onElicitation: "accept-all",
+      access: testAccess.member(),
     }),
   );
   return {

apps/local/src/executor.ts+4−0

   type Executor,
 } from "@executor-js/sdk";
 import { collectTables } from "@executor-js/api/server";
+import { singleUserAccess } from "@executor-js/product-access";
 import { loadPluginsFromJsonc } from "@executor-js/config";
 import type { McpPluginExtension } from "@executor-js/plugin-mcp";
             { plugin_key: event.pluginKey },
           ),
         onElicitation: "accept-all",
+        // Single-user product: one human owns the deployment and may
+        // configure everything (see @executor-js/product-access).
+        access: singleUserAccess(),
         oauthEndpointUrlPolicy: { allowHttp: true },
         // EXPLICIT OAuth callback — the daemon serves the v2 `/api/oauth/callback`
         // route on the same origin as the web UI. Derived from `webBaseUrl`

apps/local/src/mcp-browser-resume.test.ts+2−0

 import { createMcpRequestHandler } from "./mcp";
 import { createSqliteFumaDb } from "./db/sqlite-fumadb";
+import { testAccess } from "@executor-js/product-access/testing";
 const TEST_BASE_URL = "http://local.test";
       db: sqlite.db,
       plugins,
       onElicitation: "accept-all",
+      access: testAccess.member(),
     }),
   );

apps/local/src/mcp-oauth.test.ts+2−0

   createExecutor,
 } from "@executor-js/sdk";
 import { serveOAuthTestServer } from "@executor-js/sdk/testing";
+import { testAccess } from "@executor-js/product-access/testing";
 import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
 import { mcpPlugin } from "@executor-js/plugin-mcp";
 import { McpExtensionService, McpGroup, McpHandlers } from "@executor-js/plugin-mcp/api";
       db: sqlite.db,
       plugins,
       onElicitation: "accept-all",
+      access: testAccess.member(),
       oauthEndpointUrlPolicy: { allowHttp: true },
       // EXPLICIT OAuth callback — required now that the localhost default is
       // gone; the local daemon serves `/api/oauth/callback` on the web origin.

bun.lock+43−0

         "@effect/tsgo": "^0.5.2",
         "@effect/vitest": "catalog:",
         "@executor-js/plugin-provider-service-split": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@typescript/native-preview": "^7.0.0-dev.20260410.1",
         "@vitest/expect": "catalog:",
         "@vitest/mocker": "catalog:",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
         "@executor-js/plugin-workos-vault": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-dynamic-worker": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-dynamic-worker": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@executor-js/plugin-onepassword": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-workos-vault": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "effect": "catalog:",
       },
       "version": "0.0.54",
       "dependencies": {
         "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "effect": "catalog:",
       },
         "@executor-js/plugin-graphql": "workspace:*",
         "@executor-js/plugin-mcp": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
       },
       "devDependencies": {
       "dependencies": {
         "@executor-js/execution": "workspace:*",
         "@executor-js/host-mcp": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "effect": "catalog:",
       },
       },
       "devDependencies": {
         "@effect/vitest": "catalog:",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@types/node": "catalog:",
         "bun-types": "catalog:",
         "vitest": "catalog:",
       },
     },
+    "packages/core/product-access": {
+      "name": "@executor-js/product-access",
+      "version": "1.6.8",
+      "dependencies": {
+        "@executor-js/sdk": "workspace:*",
+      },
+      "devDependencies": {
+        "@effect/vitest": "catalog:",
+        "@types/node": "catalog:",
+        "bun-types": "catalog:",
+        "effect": "catalog:",
+        "tsup": "catalog:",
+        "typescript": "catalog:",
+        "vitest": "catalog:",
+      },
+      "peerDependencies": {
+        "effect": "catalog:",
+      },
+    },
     "packages/core/sdk": {
       "name": "@executor-js/sdk",
       "version": "1.6.8",
       "dependencies": {
         "@cfworker/json-schema": "^4.1.1",
         "@executor-js/execution": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@modelcontextprotocol/ext-apps": "^1.7.4",
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@effect/vitest": "catalog:",
         "@executor-js/execution": "workspace:*",
         "@executor-js/host-mcp": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@tailwindcss/browser": "^4.2.2",
         "@tailwindcss/vite": "catalog:",
         "@executor-js/execution": "workspace:*",
         "@executor-js/fumadb": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@types/node": "catalog:",
         "drizzle-orm": "catalog:",
         "react": "catalog:",
       },
       "devDependencies": {
+        "@executor-js/product-access": "workspace:*",
         "@types/react": "catalog:",
         "tsup": "catalog:",
         "typescript": "catalog:",
         "@executor-js/sdk": "workspace:*",
       },
       "devDependencies": {
+        "@executor-js/product-access": "workspace:*",
         "@types/node": "catalog:",
         "bun-types": "catalog:",
         "effect": "catalog:",
         "@effect/atom-react": "catalog:",
         "@effect/vitest": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@types/node": "catalog:",
         "@types/react": "catalog:",
       },
       "devDependencies": {
         "@effect/vitest": "catalog:",
+        "@executor-js/product-access": "workspace:*",
         "@types/node": "catalog:",
         "bun-types": "catalog:",
         "effect": "catalog:",
         "@effect/atom-react": "catalog:",
         "@effect/vitest": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@modelcontextprotocol/server": "2.0.0",
         "@types/node": "catalog:",
       "devDependencies": {
         "@effect/vitest": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@types/node": "catalog:",
         "@types/react": "catalog:",
         "bun-types": "catalog:",
         "@effect/atom-react": "catalog:",
         "@effect/vitest": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@types/js-yaml": "4.0.9",
         "@types/node": "catalog:",
         "@effect/atom-react": "catalog:",
         "@effect/vitest": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@tanstack/react-router": "catalog:",
         "@types/node": "catalog:",
         "@base-ui/react": "^1.3.0",
         "@effect/atom-react": "catalog:",
         "@executor-js/api": "workspace:*",
+        "@executor-js/product-access": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@hookform/resolvers": "^5.2.2",
         "@lobehub/icons": "^5.4.0",
     "@executor-js/plugin-workos-vault": ["@executor-js/plugin-workos-vault@workspace:packages/plugins/workos-vault"],
+    "@executor-js/product-access": ["@executor-js/product-access@workspace:packages/core/product-access"],
     "@executor-js/react": ["@executor-js/react@workspace:packages/react"],
     "@executor-js/runtime-deno-subprocess": ["@executor-js/runtime-deno-subprocess@workspace:packages/kernel/runtime-deno-subprocess"],

examples/all-plugins/package.json+1−0

@@ -16,6 +16,7 @@ · 15 unmodified lines
16	"@executor-js/plugin-onepassword": "workspace:*",	16	"@executor-js/plugin-onepassword": "workspace:*",
17	"@executor-js/plugin-openapi": "workspace:*",	17	"@executor-js/plugin-openapi": "workspace:*",
18	"@executor-js/plugin-workos-vault": "workspace:*",	18	"@executor-js/plugin-workos-vault": "workspace:*",
		19	"@executor-js/product-access": "workspace:*",
19	"@executor-js/sdk": "workspace:*",	20	"@executor-js/sdk": "workspace:*",
20	"effect": "catalog:"	21	"effect": "catalog:"
21	},	22	},

examples/all-plugins/src/main.ts+3−0

   ToolAddress,
   type CredentialProvider,
 } from "@executor-js/sdk";
+import { workspaceServiceAccess } from "@executor-js/product-access";
 import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
 import {
   const executor = yield* createExecutor({
     tenant: Tenant.make("example-tenant"),
+    // Subject-less single-workspace example: org partition, writes allowed.
+    access: workspaceServiceAccess(),
     plugins,
     providers: [memoryProvider],
     onElicitation: "accept-all" as const,

examples/docs-sdk-quickstart/package.json+1−0

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	},	10	},
11	"dependencies": {	11	"dependencies": {
12	"@executor-js/plugin-openapi": "workspace:*",	12	"@executor-js/plugin-openapi": "workspace:*",
		13	"@executor-js/product-access": "workspace:*",
13	"@executor-js/sdk": "workspace:*",	14	"@executor-js/sdk": "workspace:*",
14	"effect": "catalog:"	15	"effect": "catalog:"
15	},	16	},

examples/docs-sdk-quickstart/src/main.ts+4−0

   type CredentialProvider,
 } from "@executor-js/sdk/promise";
 import { openApiPlugin, variable } from "@executor-js/plugin-openapi/promise";
+import { workspaceServiceAccess } from "@executor-js/product-access";
 const inventoryApi = {
   openapi: "3.0.0",
 };
 const executor = await createExecutor({
+  // Subject-less single-workspace embedder: the product posture is stated
+  // explicitly — the SDK ships no default.
+  access: workspaceServiceAccess(),
   plugins: [openApiPlugin()],
   providers: [memoryProvider],
   onElicitation: "accept-all",

examples/promise-sdk/package.json+1−0

@@ -12,6 +12,7 @@ · 11 unmodified lines
12	"@executor-js/plugin-graphql": "workspace:*",	12	"@executor-js/plugin-graphql": "workspace:*",
13	"@executor-js/plugin-mcp": "workspace:*",	13	"@executor-js/plugin-mcp": "workspace:*",
14	"@executor-js/plugin-openapi": "workspace:*",	14	"@executor-js/plugin-openapi": "workspace:*",
		15	"@executor-js/product-access": "workspace:*",
15	"@executor-js/sdk": "workspace:*"	16	"@executor-js/sdk": "workspace:*"
16	},	17	},
17	"devDependencies": {	18	"devDependencies": {

examples/promise-sdk/src/main.ts+4−0

 import { mcpPlugin } from "@executor-js/plugin-mcp/promise";
 import { openApiPlugin, variable } from "@executor-js/plugin-openapi/promise";
 import { graphqlPlugin } from "@executor-js/plugin-graphql/promise";
+import { workspaceServiceAccess } from "@executor-js/product-access";
 // ---------------------------------------------------------------------------
 // 1. Create the executor with all plugins
 };
 const executor = await createExecutor({
+  // Subject-less single-workspace embedder: the product posture is stated
+  // explicitly — the SDK ships no default.
+  access: workspaceServiceAccess(),
   plugins,
   providers: [memoryProvider],
   onElicitation: "accept-all",

package.json+2−1

     "test": "turbo run test --filter=!@executor-js/e2e ${TURBO_TEST_CONCURRENCY:+--concurrency=$TURBO_TEST_CONCURRENCY}",
     "test:e2e": "bun run --cwd e2e test",
     "test:release:bootstrap": "vitest run tests/release-bootstrap-smoke.test.ts",
-    "build:packages": "bun run --filter='@executor-js/fumadb' build && bun run --filter='@executor-js/codemode-core' build && bun run --filter='@executor-js/runtime-quickjs' build && bun run --filter='@executor-js/sdk' build && bun run --filter='@executor-js/config' build && bun run --filter='@executor-js/execution' build && bun run --filter='@executor-js/cli' build && bun run --filter='@executor-js/plugin-*' build",
+    "build:packages": "bun run --filter='@executor-js/fumadb' build && bun run --filter='@executor-js/codemode-core' build && bun run --filter='@executor-js/runtime-quickjs' build && bun run --filter='@executor-js/sdk' build && bun run --filter='@executor-js/product-access' build && bun run --filter='@executor-js/config' build && bun run --filter='@executor-js/execution' build && bun run --filter='@executor-js/cli' build && bun run --filter='@executor-js/plugin-*' build",
     "typecheck": "turbo run typecheck",
     "typecheck:slow": "turbo run typecheck:slow",
     "ci": "bun run lint && bun run typecheck && bun run test",
     "@effect/tsgo": "^0.5.2",
     "@effect/vitest": "catalog:",
     "@executor-js/plugin-provider-service-split": "workspace:*",
+    "@executor-js/product-access": "workspace:*",
     "@typescript/native-preview": "^7.0.0-dev.20260410.1",
     "@vitest/expect": "catalog:",
     "@vitest/mocker": "catalog:",

packages/core/api/package.json+1−0

@@ -16,6 +16,7 @@ · 15 unmodified lines
16	"dependencies": {	16	"dependencies": {
17	"@executor-js/execution": "workspace:*",	17	"@executor-js/execution": "workspace:*",
18	"@executor-js/host-mcp": "workspace:*",	18	"@executor-js/host-mcp": "workspace:*",
		19	"@executor-js/product-access": "workspace:*",
19	"@executor-js/sdk": "workspace:*",	20	"@executor-js/sdk": "workspace:*",
20	"effect": "catalog:"	21	"effect": "catalog:"
21	},	22	},

packages/core/api/src/admin/admin-users.test.ts+4−2

   type ExecutorAdmin,
 } from "@executor-js/sdk";
 import { createSqliteTestFumaDb, type SqliteTestFumaDb } from "@executor-js/sdk/testing";
+import { testAccess } from "@executor-js/product-access/testing";
 import { resetSubjectTouchCache, touchSubject } from "@executor-js/sdk/host-internal";
 import { AdminUsersHttpApi, AdminUsersForbidden, AdminUsersUnauthorized } from "./api";
     tenant: Tenant.make(tenant),
     db: db.db,
     onElicitation: "accept-all",
-    platformView: true,
+    access: testAccess.platform({ subject: false }),
   }).pipe(Effect.orDie);
 /** A product-view executor: bound to one subject, no platform view at all. */
     subject: Subject.make(USER_A1),
     db: db.db,
     onElicitation: "accept-all",
+    access: testAccess.member(),
   }).pipe(Effect.orDie);
 /**
     withDb((db) =>
       Effect.gen(function* () {
         yield* seed(db);
-        // A host that forgot `platformView: true` must not silently report an
+        // A host that forgot the platform access posture must not silently report an
         // empty tenant — that would read as "this owner has no users".
         const web = yield* webHandlerFor(
           stubProvider((tenant) => productExecutorFor(db, tenant), headerAuthorize),

packages/core/api/src/admin/api.ts+1−1

@@ -4,7 +4,7 @@ · 3 unmodified lines
4	// The product plane (`/api/*`) answers "what can I, this member, reach". This	4	// The product plane (`/api/*`) answers "what can I, this member, reach". This
5	// one answers the OWNER's question: "who are my users, and what have they	5	// one answers the OWNER's question: "who are my users, and what have they
6	// connected". It reads the SDK's platform view (`executor.admin`, opt-in via	6	// connected". It reads the SDK's platform view (`executor.admin`, opt-in via
7	// `platformView: true`), which is read-only by construction — the owner policy	7	// `platformObserverAccess()`), which is read-only by construction — the owner policy
8	// rejects writes at `reach: "tenant"` — so every endpoint here is a GET.	8	// rejects writes at `reach: "tenant"` — so every endpoint here is a GET.
9	//	9	//
10	// VOCABULARY: this is the translation seam. Internal code says subject / tenant	10	// VOCABULARY: this is the translation seam. Internal code says subject / tenant

packages/core/api/src/admin/reads.ts+1−1

@@ -35,7 +35,7 @@ import type { AdminUsersListOptions } from "./service"; · 34 unmodified lines
35		35
36	/**	36	/**
37	* Narrow an executor to its platform view. `admin` is present only when the	37	* Narrow an executor to its platform view. `admin` is present only when the
38	* executor was built with `platformView: true`; a host that reaches these reads	38	* executor was built with the platform access posture; a host that reaches these reads
39	* with a product-view executor is a wiring bug, so it fails loudly as a 500	39	* with a product-view executor is a wiring bug, so it fails loudly as a 500
40	* rather than silently returning an empty tenant (which would read as "this	40	* rather than silently returning an empty tenant (which would read as "this
41	* owner has no users").	41	* owner has no users").

packages/core/api/src/integrations/integrations-auth-methods.test.ts+13−4

 import { ExecutorApi } from "../api";
 import { observabilityMiddleware } from "../observability";
 import { CoreHandlers, ExecutionEngineService, ExecutorService } from "../server";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // The catalog response surfaces each plugin's DECLARED auth methods (projected
 describe("catalog surfaces declared auth methods", () => {
   it.effect("an OAuth integration with zero connections advertises an oauth method", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [declaringPlugin] }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [declaringPlugin] }),
+      );
       const slug = IntegrationSlug.make("oauth-server");
       yield* executor.declaring.seed(slug, [OAUTH_METHOD]);
   it.effect("an apikey integration advertises an apikey method", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [declaringPlugin] }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [declaringPlugin] }),
+      );
       const slug = IntegrationSlug.make("apikey-server");
       yield* executor.declaring.seed(slug, [APIKEY_METHOD]);
   it.effect("list surfaces authMethods and a plugin with no projector yields []", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [declaringPlugin] }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [declaringPlugin] }),
+      );
       yield* executor.declaring.seed(IntegrationSlug.make("oauth-server"), [OAUTH_METHOD]);
       yield* executor.declaring.seed(IntegrationSlug.make("bare-server"), []);
   it.effect("surfaces plugin-derived display URLs without exposing config", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [declaringPlugin] }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [declaringPlugin] }),
+      );
       const slug = IntegrationSlug.make("autumn");
       yield* executor.declaring.seed(slug, [], "https://api.useautumn.com");

packages/core/api/src/scoped-targets.test.ts+5−1

 import { ExecutorApi } from "./api";
 import { observabilityMiddleware } from "./observability";
 import { CoreHandlers, ExecutionEngineService, ExecutorService } from "./server";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // v2 owner-scoped API behaviour.
 describe("core API owner-scoped writes (v2)", () => {
   it.effect("policy create + update target an explicit owner", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({}));
+      const executor = yield* createExecutor(makeTestConfig({ access: testAccess.member() }));
       const web = yield* webHandlerFor(executor);
       const context = handlerContextFor(executor);
   it.effect("connection remove deletes the named owner row, not the other owner", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), vercelPlugin] as const,
       });
       const executor = yield* createExecutor(config);
   it.effect("connection create accepts pasted values payloads", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), vercelPlugin] as const,
       });
       const executor = yield* createExecutor(config);
   it.effect("connection list returns both owners' rows under one integration", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), vercelPlugin] as const,
       });
       const executor = yield* createExecutor(config);

packages/core/api/src/server/execution-stack-middleware.ts+4−4

 import { Context, Data, Effect, Layer } from "effect";
 import type * as Cause from "effect/Cause";
+import { memberAccessForRole } from "@executor-js/product-access";
 import type { AnyPlugin } from "@executor-js/sdk";
 import type { ExecutionEngine } from "@executor-js/execution";
             resolved.organizationId,
             resolved.organizationName,
             {
-              orgWrites:
+              // The product's role rule, decided from the freshly resolved
-                resolved.orgRoleModel === "none" || resolved.orgRole === "admin"
+              // principal for exactly this request's stack.
-                  ? "allowed"
+              access: memberAccessForRole(resolved),
-                  : "denied",
             },
           ).pipe(
             Effect.provide(options.stackLayer, { local: true }),

packages/core/api/src/server/execution-stack.ts+9−8

 import type * as Cause from "effect/Cause";
 import type { McpResource } from "@executor-js/host-mcp";
-import type { AnyPlugin, Executor, ExecutorConfig, StorageFailure } from "@executor-js/sdk";
+import type { AnyPlugin, Executor, ExecutorAccess, StorageFailure } from "@executor-js/sdk";
 import {
   createExecutionEngine,
   type ExecutionEngine,
   accountId: string,
   organizationId: string,
   organizationName: string,
-  options?: {
+  options: {
     readonly mcpResource?: McpResource;
-    /** Workspace-settings permission for this binding (see
+    /** The product's access decisions for this binding (see
-     *  `ExecutorConfig.orgWrites`), derived from the acting member's role. */
+     *  `ExecutorConfig.access`), selected by the host — role-derived on the
-    readonly orgWrites?: ExecutorConfig<TPlugins>["orgWrites"];
+     *  HTTP plane, request-bound on MCP session stacks. */
+    readonly access: ExecutorAccess;
   },
 ): Effect.Effect<
   { readonly executor: Executor<TPlugins>; readonly engine: ExecutionEngine<Cause.YieldableError> },
       organizationId,
       organizationName,
       {
-        plugins: { mcpResource: options?.mcpResource },
+        plugins: { mcpResource: options.mcpResource },
-        ...(options?.orgWrites === undefined ? {} : { orgWrites: options.orgWrites }),
+        access: options.access,
       },
     ).pipe(Effect.withSpan("executor.stack.scoped_executor"));
     const codeExecutor = yield* CodeExecutorProvider.asEffect().pipe(
           organizationId,
           organizationName,
         },
-        { mcpResource: options?.mcpResource },
+        { mcpResource: options.mcpResource },
       ),
     );
     return { executor, engine };

packages/core/api/src/server/mcp-build.ts+5−1

 import { Effect, Layer } from "effect";
 import { McpErrorReporter, type Principal } from "@executor-js/host-mcp";
+import { requestBoundMemberAccess } from "@executor-js/product-access";
 import {
   McpEngineBuildError,
   type McpBuildServer,
         principal.organizationName,
         {
           mcpResource: options?.resource,
-          orgWrites: "request",
+          // Session-lifetime stack: the workspace-settings decision is read
+          // from the request-stamped fiber-local at every guarded sink, so a
+          // session never caches a positive authorization.
+          access: requestBoundMemberAccess(),
         },
       ).pipe(Effect.withSpan("mcp.execution_stack.build"));
       // Read inside the provided boundary: `webBaseUrl` is a host seam, and

packages/core/api/src/server/scoped-executor.ts+12−9

 import { Context, Effect, Option } from "effect";
 import type { McpResource } from "@executor-js/host-mcp";
+import { platformObserverAccess } from "@executor-js/product-access";
 import {
   createExecutor,
   Subject,
   Tenant,
   type AnyPlugin,
   type Executor,
+  type ExecutorAccess,
   type ExecutorConfig,
   type FirstPartyOAuthClientConfig,
   type StorageFailure,
   // `EngineStackIdentity` (the engine decorator still wants it); not part of the
   // v2 executor binding, which is `{ tenant, subject }` only.
   _organizationName: string,
-  options?: {
+  options: {
     readonly plugins?: PluginsProviderContext;
-    /** Workspace-settings permission for this binding (see
+    /** The product's access decisions for this binding (see
-     *  `ExecutorConfig.orgWrites`). Hosts derive it from the acting member's
+     *  `ExecutorConfig.access`) — REQUIRED, selected by the host from
-     *  role; omitted -> allowed (hosts with no role model). */
+     *  `@executor-js/product-access` (role-derived on the HTTP plane,
-    readonly orgWrites?: ExecutorConfig<TPlugins>["orgWrites"];
+     *  request-bound on session stacks). */
+    readonly access: ExecutorAccess;
   },
 ): Effect.Effect<Executor<TPlugins>, StorageFailure, DbProvider | PluginsProvider | HostConfig> =>
   Effect.gen(function* () {
       ...(config.toolsSyncTtlMs !== undefined ? { toolsSyncTtlMs: config.toolsSyncTtlMs } : {}),
       ...(waitUntil !== undefined ? { waitUntil } : {}),
       onElicitation: "accept-all",
-      ...(options?.orgWrites === undefined ? {} : { orgWrites: options.orgWrites }),
+      access: options.access,
       redirectUri,
       oauthCallbackStateOrgSlug: orgSlug,
       firstPartyOAuthClients: config.firstPartyOAuthClients,
 // An org-level caller (a WorkOS org-scoped API key, or an owner/admin acting on
 // the whole workspace) has NO acting member, so there is no honest subject to
 // bind. This builds the executor that shape implies: `{ tenant, subject:
-// undefined, platformView: true }`.
+// undefined, access: platformObserverAccess() }`.
 //
-// WHAT "READ-ONLY" MEANS HERE, PRECISELY. `platformView: true` puts
+// WHAT "READ-ONLY" MEANS HERE, PRECISELY. The platform access posture puts
 // `writes: "denied"` on the executor's base owner-policy context and
 // `reach: "tenant"` on the `admin` handle's. So:
 //   - EVERY surface on this executor — `admin`, and the ordinary `connections`
       httpClientLayer: makeHostedHttpClientLayer(hostedHttpOptions),
       fetch: makeHostedFetch(hostedHttpOptions),
       onElicitation: "accept-all",
-      platformView: true,
+      access: platformObserverAccess(),
     }).pipe(Effect.withSpan("executor.platform.create_executor"));
   });

packages/core/execution/README.md+2−0

 ## Usage
 ```ts
+import { workspaceServiceAccess } from "@executor-js/product-access";
 import { createExecutor } from "@executor-js/sdk";
 import { createExecutionEngine } from "@executor-js/execution";
 import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";
 const executor = await createExecutor({
   onElicitation: "accept-all",
+  access: workspaceServiceAccess(),
 });
 const engine = createExecutionEngine({

packages/core/execution/package.json+1−0

@@ -48,6 +48,7 @@ · 47 unmodified lines
48	},	48	},
49	"devDependencies": {	49	"devDependencies": {
50	"@effect/vitest": "catalog:",	50	"@effect/vitest": "catalog:",
		51	"@executor-js/product-access": "workspace:*",
51	"@executor-js/runtime-quickjs": "workspace:*",	52	"@executor-js/runtime-quickjs": "workspace:*",
52	"@types/node": "catalog:",	53	"@types/node": "catalog:",
53	"bun-types": "catalog:",	54	"bun-types": "catalog:",

packages/core/execution/src/description.test.ts+19−5

 import { makeTestConfig } from "@executor-js/sdk/testing";
 import { buildExecuteDescription, parseIntegrationInventory } from "./description";
+import { testAccess } from "@executor-js/product-access/testing";
 const memoryProvider = (): CredentialProvider => {
   const store = new Map<string, string>();
   it.effect("lists the connected integrations, not the connection prefixes", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [slackPlugin, githubPlugin] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [slackPlugin, githubPlugin] as const,
+        }),
       );
       yield* executor["slack-plugin"].seed();
       yield* executor["github-plugin"].seed();
   it.effect("lists integration names only, with no descriptions", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [slackPlugin, githubPlugin] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [slackPlugin, githubPlugin] as const,
+        }),
       );
       yield* executor["slack-plugin"].seed();
       yield* executor["github-plugin"].seed();
   it.effect("dedupes many connections of one integration into a single line", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [githubPlugin] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [githubPlugin] as const }),
+      );
       yield* executor["github-plugin"].seed();
       yield* executor.connections.create({
         owner: "org",
   it.effect("omits the Available integrations section when no connections exist", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [] as const }),
+      );
       const description = yield* buildExecuteDescription(executor);
   it.effect("round-trips the slugs a built description lists", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [slackPlugin, githubPlugin] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [slackPlugin, githubPlugin] as const,
+        }),
       );
       yield* executor["slack-plugin"].seed();
       yield* executor["github-plugin"].seed();

packages/core/execution/src/engine.test.ts+7−3

 import { createExecutionEngine, formatExecuteResult, formatPausedExecution } from "./engine";
 import { FormElicitation } from "@executor-js/sdk/core";
+import { testAccess } from "@executor-js/product-access/testing";
 // Regression for the hang reported as the executor-MCP "180s timeout" against
 // Cowork (Claude web). Cowork goes down the `executeWithPause` branch because
   staticIntegrations: () => [],
 }));
-const makeExecutor = () => createExecutor(makeTestConfig({ plugins: [emptyPlugin()] as const }));
+const makeExecutor = () =>
+  createExecutor(
+    makeTestConfig({ access: testAccess.member(), plugins: [emptyPlugin()] as const }),
+  );
 describe("executeWithPause failure propagation", () => {
   it.effect("surfaces a fast codeExecutor failure as an Exit.Failure", () =>
   it.effect("uses the resumer's current org-write access after approval", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ coreTools: {}, orgWrites: "request" }),
+        makeTestConfig({ coreTools: {}, access: testAccess.requestBound() }),
       );
       const engine = createExecutionEngine({
         executor,
       const executor = yield* createExecutor(
         makeTestConfig({
           coreTools: {},
-          orgWrites: "request",
+          access: testAccess.requestBound(),
           plugins: [joinPlugin()] as const,
         }),
       );

packages/core/execution/src/tool-invoker.leak.test.ts+19−6

 import { makeTestConfig } from "@executor-js/sdk/testing";
 import { ExecutionToolError } from "./errors";
 import { makeExecutorToolInvoker } from "./tool-invoker";
+import { testAccess } from "@executor-js/product-access/testing";
 const EmptyInputSchema = Schema.toStandardSchemaV1(
   Schema.toStandardJSONSchemaV1(Schema.Struct({})),
 describe("internal-error leak audit (opaque defects)", () => {
   it.effect("plugin tagged error: defect surfaces only as opaque generic + correlation id", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });
   it.effect("plain Error with stack: stack and message do NOT escape", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });
 describe("openapi pre-flight invocation errors (expected failures)", () => {
   it.effect("missing path parameter surfaces verbatim as invalid_tool_arguments", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });
   it.effect("missing request body surfaces verbatim as invalid_tool_arguments", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });
   it.effect("transport failure (statusCode None but cause present) stays opaque", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });
   it.effect("post-response failure (statusCode Some) stays opaque", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [leakyPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [leakyPlugin()] as const }),
+      );
       const invoker = makeExecutorToolInvoker(executor, {
         invokeOptions: { onElicitation: acceptAll },
       });

packages/core/execution/src/tool-invoker.test.ts+5−1

   searchTools,
   type ToolDiscoveryProvider,
 } from "./tool-invoker";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // v2 port. The v1 suite modelled namespaces as `staticSources` whose tools
   });
 const makeExecutorWith = <const TPlugins extends readonly AnyPlugin[]>(plugins: TPlugins) =>
-  createExecutor(makeTestConfig({ plugins }));
+  createExecutor(makeTestConfig({ access: testAccess.member(), plugins }));
 const makeSearchExecutor = () =>
   Effect.gen(function* () {
         });
         const executor = yield* createExecutor(
           makeTestConfig({
+            access: testAccess.member(),
             plugins: [memoryCredentialsPlugin()] as const,
             coreTools: {},
           }),
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const config = makeTestConfig({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin(), oauthErrorPlugin] as const,
         });
         const executor = yield* createExecutor(config);
           invalidRefreshTokenDescription: "Refresh token expired",
         });
         const config = makeTestConfig({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin(), oauthErrorPlugin] as const,
         });
         const executor = yield* createExecutor(config);

packages/core/product-access/CHANGELOG.md+1−0

@@ -0,0 +1 @@
		1	# @executor-js/product-access

packages/core/product-access/README.md+79−0

@@ -0,0 +1,79 @@
	1	# @executor-js/product-access
	2
	3	The product's personal/organization access rules for
	4	[`@executor-js/sdk`](../sdk). The SDK executes tools and enforces tenant
	5	isolation; it deliberately owns no product rule. Every `createExecutor` call
	6	requires an `ExecutorAccess` — the product's decisions for:
	7
	8	- `owners` — which owner partitions (`"user"`, `"org"`) the binding sees
	9	and may write, in precedence order. Really filters storage CRUD, tool
	10	list/schema/invoke, plugin storage and plugin blobs.
	11	- `settingsWrite(target)` — whether a user-intent settings mutation
	12	(connections, policies, OAuth clients, the integration catalog) is allowed,
	13	asked live at every sink.
	14	- `capabilities` — `adminReads` (the tenant-wide read-only admin surface)
	15	and `storageWrites` (`"denied"` = whole-executor read-only).
	16	- `toolPolicy(sources)` — how stored policy rows and toolkit capability
	17	rules resolve into an effective allow/approve/block decision.
	18
	19	This package ships the standard rules. Core never falls back to them — a
	20	composition root states its posture explicitly.
	21
	22	## Effect SDK
	23
	24	```ts
	25	import { Effect } from "effect";
	26	import { createExecutor } from "@executor-js/sdk/core";
	27	import { singleUserAccess } from "@executor-js/product-access";
	28
	29	const program = Effect.gen(function* () {
	30	const executor = yield* createExecutor({
	31	tenant,
	32	subject,
	33	onElicitation: "accept-all",
	34	access: singleUserAccess(),
	35	});
	36	// Execution stays on the executor namespaces: executor.tools, executor.execute, …
	37	});
	38	```
	39
	40	## Promise SDK
	41
	42	```ts
	43	import { createExecutor } from "@executor-js/sdk"; // published root = Promise API
	44	import { workspaceServiceAccess } from "@executor-js/product-access";
	45
	46	const executor = await createExecutor({
	47	onElicitation: "accept-all",
	48	// Subject-less single-workspace embedder posture.
	49	access: workspaceServiceAccess(),
	50	});
	51	```
	52
	53	## Postures
	54
	55	\| Constructor \| Binding \| Used by \|
	56	\| ------------------------------------------------ \| ----------------------------------------------------------------------------------------------------- \| ----------------------------------- \|
	57	\| `singleUserAccess()` \| bound subject, everything allowed \| local daemon, CLI, desktop \|
	58	\| `memberAccessForRole({ orgRoleModel, orgRole })` \| bound member; admins configure, members use \| HTTP API plane \|
	59	\| `requestBoundMemberAccess()` \| bound member; decision re-read per request via `CurrentOrgWriteAccess`, re-stamped on approval resume \| MCP session stacks \|
	60	\| `workspaceServiceAccess()` \| subject-less org service; boot convergence \| seeding/system executors, embedders \|
	61	\| `platformObserverAccess()` \| subject-less, storage read-only, tenant-wide `admin` reads \| `/admin/*` org-credential plane \|
	62
	63	`orgWriteAccessForRole` is the single home of the admin/member rule.
	64	`./policy` exports the resolution semantics (owner ranking, most-restrictive
	65	merge, plugin-default fallback, toolkit allowlist) — browser-safe, built on
	66	`@executor-js/sdk/shared`. `./testing` exports `testAccess` postures for
	67	tests (`makeTestConfig({ access: testAccess.member() })`).
	68
	69	## Breaking changes (from the pre-split SDK)
	70
	71	- `ExecutorConfig.orgWrites` and `platformView` are gone; `access` is
	72	required on both the Effect and Promise `createExecutor`.
	73	- `makeTestConfig` / `makeTestWorkspaceHarness` / `makeTestExecutor` /
	74	`makeTestWorkspaceLayer` require `access`.
	75	- Policy resolution functions moved here from `@executor-js/sdk`
	76	(`resolveEffectivePolicy`, `effectivePolicyFromSorted`, …); pattern
	77	matching (`matchPattern`, `isValidPattern`) stays in the SDK.
	78	- No stored schema or data migration: rows, tenants, owners, subjects and
	79	tool addresses are unchanged.

packages/core/product-access/package.json+67−0

@@ -0,0 +1,67 @@
	1	{
	2	"name": "@executor-js/product-access",
	3	"version": "1.6.8",
	4	"homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/product-access",
	5	"bugs": {
	6	"url": "https://github.com/UsefulSoftwareCo/executor/issues"
	7	},
	8	"license": "MIT",
	9	"repository": {
	10	"type": "git",
	11	"url": "git+https://github.com/UsefulSoftwareCo/executor.git",
	12	"directory": "packages/core/product-access"
	13	},
	14	"files": [
	15	"dist"
	16	],
	17	"type": "module",
	18	"exports": {
	19	".": "./src/index.ts",
	20	"./policy": "./src/policy.ts",
	21	"./testing": "./src/testing.ts"
	22	},
	23	"publishConfig": {
	24	"access": "public",
	25	"exports": {
	26	".": {
	27	"import": {
	28	"types": "./dist/index.d.ts",
	29	"default": "./dist/index.js"
	30	}
	31	},
	32	"./policy": {
	33	"import": {
	34	"types": "./dist/policy.d.ts",
	35	"default": "./dist/policy.js"
	36	}
	37	},
	38	"./testing": {
	39	"import": {
	40	"types": "./dist/testing.d.ts",
	41	"default": "./dist/testing.js"
	42	}
	43	}
	44	}
	45	},
	46	"scripts": {
	47	"build": "tsup && tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src",
	48	"typecheck": "tsgo --noEmit",
	49	"test": "vitest run",
	50	"typecheck:slow": "bunx tsc --noEmit -p tsconfig.json"
	51	},
	52	"dependencies": {
	53	"@executor-js/sdk": "workspace:*"
	54	},
	55	"devDependencies": {
	56	"@effect/vitest": "catalog:",
	57	"@types/node": "catalog:",
	58	"bun-types": "catalog:",
	59	"effect": "catalog:",
	60	"tsup": "catalog:",
	61	"typescript": "catalog:",
	62	"vitest": "catalog:"
	63	},
	64	"peerDependencies": {
	65	"effect": "catalog:"
	66	}
	67	}

packages/core/product-access/src/index.test.ts+185−0

@@ -0,0 +1,185 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { Effect, Ref } from "effect";
	3
	4	import {
	5	CurrentOrgWriteAccess,
	6	makeOrgWriteAccessState,
	7	type ToolPolicyRow,
	8	} from "@executor-js/sdk/core";
	9
	10	import {
	11	memberAccess,
	12	memberAccessForRole,
	13	orgWriteAccessForRole,
	14	platformObserverAccess,
	15	requestBoundMemberAccess,
	16	singleUserAccess,
	17	workspaceServiceAccess,
	18	} from "./index";
	19	import { resolveProviderPolicyFromRules, standardToolPolicy } from "./policy";
	20
	21	describe("orgWriteAccessForRole", () => {
	22	it("trusts the single user of a deployment without a role model", () => {
	23	expect(orgWriteAccessForRole({ orgRoleModel: "none" })).toBe("allowed");
	24	});
	25
	26	it("lets admins configure the workspace under a role model", () => {
	27	expect(orgWriteAccessForRole({ orgRoleModel: "organization", orgRole: "admin" })).toBe(
	28	"allowed",
	29	);
	30	});
	31
	32	it("denies plain members", () => {
	33	expect(orgWriteAccessForRole({ orgRoleModel: "organization", orgRole: "member" })).toBe(
	34	"denied",
	35	);
	36	});
	37
	38	it("fails closed when a role model is present but the role is missing", () => {
	39	expect(orgWriteAccessForRole({ orgRoleModel: "organization" })).toBe("denied");
	40	});
	41	});
	42
	43	describe("settings-write rules", () => {
	44	it.effect("the role decision gates workspace targets; personal stays open", () =>
	45	Effect.gen(function* () {
	46	const member = memberAccessForRole({ orgRoleModel: "organization", orgRole: "member" });
	47	const admin = memberAccessForRole({ orgRoleModel: "organization", orgRole: "admin" });
	48	expect(yield* member.settingsWrite({ kind: "workspace" })).toBe("denied");
	49	expect(yield* member.settingsWrite({ kind: "owner", owner: "org" })).toBe("denied");
	50	expect(yield* member.settingsWrite({ kind: "owner", owner: "user" })).toBe("allowed");
	51	expect(yield* admin.settingsWrite({ kind: "workspace" })).toBe("allowed");
	52	expect(admin.owners).toEqual(["user", "org"]);
	53	expect(admin.capabilities).toEqual({ adminReads: false, storageWrites: "allowed" });
	54	}),
	55	);
	56
	57	it.effect("requestBoundMemberAccess fails closed without a request binding", () =>
	58	Effect.gen(function* () {
	59	const access = requestBoundMemberAccess();
	60	expect(yield* access.settingsWrite({ kind: "workspace" })).toBe("denied");
	61	// Personal targets never consult the request decision.
	62	expect(yield* access.settingsWrite({ kind: "owner", owner: "user" })).toBe("allowed");
	63	}),
	64	);
	65
	66	it.effect("requestBoundMemberAccess reads the live request binding at every ask", () =>
	67	Effect.gen(function* () {
	68	const access = requestBoundMemberAccess();
	69	const state = makeOrgWriteAccessState("allowed");
	70	const ask = access
	71	.settingsWrite({ kind: "owner", owner: "org" })
	72	.pipe(Effect.provideService(CurrentOrgWriteAccess, state));
	73	expect(yield* ask).toBe("allowed");
	74	// The engine re-stamps this Ref from the resuming principal; the SAME
	75	// access value must observe the new decision, not a snapshot.
	76	yield* Ref.set(state.current, "denied");
	77	expect(yield* ask).toBe("denied");
	78	}),
	79	);
	80
	81	it.effect("single-user and workspace-service postures allow workspace writes", () =>
	82	Effect.gen(function* () {
	83	const single = singleUserAccess();
	84	const service = workspaceServiceAccess();
	85	expect(yield* single.settingsWrite({ kind: "workspace" })).toBe("allowed");
	86	expect(single.owners).toEqual(["user", "org"]);
	87	expect(yield* service.settingsWrite({ kind: "workspace" })).toBe("allowed");
	88	expect(service.owners).toEqual(["org"]);
	89	expect(yield* memberAccess("denied").settingsWrite({ kind: "workspace" })).toBe("denied");
	90	}),
	91	);
	92
	93	it("the platform observer is a subject-less read-only view with admin reads", () => {
	94	const access = platformObserverAccess();
	95	expect(access.owners).toEqual(["org"]);
	96	expect(access.capabilities).toEqual({ adminReads: true, storageWrites: "denied" });
	97	});
	98	});
	99
	100	describe("standardToolPolicy", () => {
	101	const row = (
	102	id: string,
	103	owner: "org" \| "user",
	104	pattern: string,
	105	action: "approve" \| "require_approval" \| "block",
	106	): ToolPolicyRow =>
	107	({
	108	id,
	109	owner,
	110	subject: owner === "org" ? "" : "u",
	111	pattern,
	112	action,
	113	position: "a0",
	114	created_at: new Date(0),
	115	updated_at: new Date(0),
	116	}) as ToolPolicyRow;
	117
	118	const evaluate = (
	119	rows: readonly ReturnType<typeof row>[],
	120	toolId: string,
	121	defaultRequiresApproval?: boolean,
	122	) =>
	123	Effect.gen(function* () {
	124	const evaluator = yield* standardToolPolicy(["user", "org"])({
	125	policyRows: Effect.succeed(rows),
	126	provider: null,
	127	});
	128	return yield* evaluator.resolve({ toolId, defaultRequiresApproval });
	129	});
	130
	131	it.effect("an org guardrail beats a user preference", () =>
	132	Effect.gen(function* () {
	133	const effective = yield* evaluate(
	134	[
	135	row("outer", "org", "vercel.*", "block"),
	136	row("inner", "user", "vercel.dns.create", "approve"),
	137	],
	138	"vercel.dns.create",
	139	);
	140	expect(effective).toMatchObject({ action: "block", policyId: "outer" });
	141	}),
	142	);
	143
	144	it.effect("no authored match falls back to the plugin default", () =>
	145	Effect.gen(function* () {
	146	expect(yield* evaluate([], "vercel.dns.create", true)).toMatchObject({
	147	action: "require_approval",
	148	source: "plugin-default",
	149	});
	150	expect(yield* evaluate([], "vercel.dns.create")).toMatchObject({
	151	action: "approve",
	152	source: "plugin-default",
	153	});
	154	}),
	155	);
	156
	157	it.effect("a list-only provider is an allowlist: unmatched tools block", () =>
	158	Effect.gen(function* () {
	159	const evaluator = yield* standardToolPolicy(["user", "org"])({
	160	policyRows: Effect.succeed([]),
	161	provider: {
	162	list: () =>
	163	Effect.succeed([
	164	{ id: "r1", pattern: "github.*", action: "approve" as const, position: "a0" },
	165	]),
	166	},
	167	});
	168	expect(yield* evaluator.resolve({ toolId: "github.org.acme.repos.list" })).toMatchObject({
	169	action: "approve",
	170	});
	171	expect(yield* evaluator.resolve({ toolId: "vercel.org.acme.deploy" })).toMatchObject({
	172	action: "block",
	173	pattern: "*",
	174	});
	175	}),
	176	);
	177
	178	it("resolveProviderPolicyFromRules picks the first match by position", () => {
	179	const rules = [
	180	{ id: "b", pattern: "github.*", action: "block" as const, position: "a1" },
	181	{ id: "a", pattern: "github.*", action: "approve" as const, position: "a0" },
	182	];
	183	expect(resolveProviderPolicyFromRules("github.x", rules)).toMatchObject({ policyId: "a" });
	184	});
	185	});

packages/core/product-access/src/index.ts+159−0

@@ -0,0 +1,159 @@
	1	// ---------------------------------------------------------------------------
	2	// @executor-js/product-access — the PRODUCT's personal/organization access
	3	// rules, stated once and selected explicitly by every composition root.
	4	//
	5	// The SDK owns none of these. `createExecutor` requires an `ExecutorAccess`
	6	// and enforces its decisions at core's sinks — storage row visibility and
	7	// write partitions (`owners`), the user-intent settings gate
	8	// (`settingsWrite`), view capabilities (`capabilities`), and effective
	9	// tool-policy evaluation (`toolPolicy`) — while the storage owner policy
	10	// keeps clamping everything to the binding's tenant/subject partition.
	11	// This package is where "what may this principal touch" is decided:
	12	// - the role rule (admins configure the workspace, members use it),
	13	// - the personal-stays-open settings rule (a denied member still manages
	14	// Personal-scope resources),
	15	// - the request-bound session posture (MCP sessions re-decide per request
	16	// and re-stamp on approval resume),
	17	// - the single-user posture (local daemon / CLI / examples),
	18	// - the subject-less workspace-service and platform-observer postures,
	19	// - how authored policy rows and toolkit capability rules resolve
	20	// (`./policy`).
	21	// Non-HTTP hosts consume it without pulling `@executor-js/api`.
	22	//
	23	// Imports come from the PUBLISHED sdk entries: `@executor-js/sdk/core` (the
	24	// Effect SDK; the sdk ROOT export is the Promise façade) and the
	25	// browser-safe `@executor-js/sdk/shared` inside `./policy`.
	26	// ---------------------------------------------------------------------------
	27
	28	import { Effect } from "effect";
	29
	30	import {
	31	currentOrgWriteAccess,
	32	type AccessDecision,
	33	type ExecutorAccess,
	34	type OrgWriteAccess,
	35	type Owner,
	36	type SettingsWriteTarget,
	37	} from "@executor-js/sdk/core";
	38
	39	import { standardToolPolicy } from "./policy";
	40
	41	export {
	42	effectivePolicyFromSorted,
	43	resolveEffectivePolicy,
	44	resolveProviderPolicyFromRules,
	45	resolveToolPolicy,
	46	standardToolPolicy,
	47	type ToolPolicyRuleLike,
	48	} from "./policy";
	49
	50	/** The role shape the org-write rule reads — structural, so both the API's
	51	* `Principal` and host-mcp's schema'd copy satisfy it without translation. */
	52	export interface OrgRoleInput {
	53	/** `"organization"` when the deployment has an org role model, `"none"`
	54	* when it does not (self-host single-org, local). */
	55	readonly orgRoleModel: "organization" \| "none";
	56	/** The acting member's role under an `"organization"` model. Missing at a
	57	* legacy boundary fails closed (treated as a plain member). */
	58	readonly orgRole?: "admin" \| "member" \| undefined;
	59	}
	60
	61	/**
	62	* THE product rule for workspace-settings writes: a deployment without a
	63	* role model trusts its user; under a role model only admins configure the
	64	* workspace, and an absent role fails closed. Previously duplicated by the
	65	* HTTP execution-stack middleware and the MCP serving seams — this is now
	66	* the single home.
	67	*/
	68	export const orgWriteAccessForRole = (input: OrgRoleInput): OrgWriteAccess =>
	69	input.orgRoleModel === "none" \|\| input.orgRole === "admin" ? "allowed" : "denied";
	70
	71	/** A bound member's partitions, personal shadowing shared. */
	72	const MEMBER_OWNERS: readonly Owner[] = ["user", "org"];
	73	/** A subject-less binding's single partition. */
	74	const ORG_OWNERS: readonly Owner[] = ["org"];
	75
	76	/**
	77	* The settings rule every current product shares: Personal-scope targets
	78	* are always the member's own to configure; workspace-level targets (org
	79	* rows and tenant-shared surfaces) follow the workspace decision, evaluated
	80	* LIVE at each sink so a request-bound decision is re-read after pauses.
	81	*/
	82	const personalOpenSettingsWrite =
	83	(workspace: Effect.Effect<AccessDecision>) =>
	84	(target: SettingsWriteTarget): Effect.Effect<AccessDecision> =>
	85	target.kind === "owner" && target.owner === "user"
	86	? Effect.succeed("allowed" as const)
	87	: workspace;
	88
	89	const memberCapabilities = { adminReads: false, storageWrites: "allowed" } as const;
	90
	91	const memberPosture = (workspace: Effect.Effect<AccessDecision>): ExecutorAccess => ({
	92	owners: MEMBER_OWNERS,
	93	settingsWrite: personalOpenSettingsWrite(workspace),
	94	capabilities: memberCapabilities,
	95	toolPolicy: standardToolPolicy(MEMBER_OWNERS),
	96	});
	97
	98	/**
	99	* A bound member whose workspace-settings decision was made from the freshly
	100	* authenticated request and holds for its lifetime — the HTTP API plane,
	101	* where every request re-authenticates and builds a new stack.
	102	*/
	103	export const memberAccess = (workspaceWrites: OrgWriteAccess): ExecutorAccess =>
	104	memberPosture(Effect.succeed(workspaceWrites));
	105
	106	/** {@link memberAccess} with the decision derived by {@link orgWriteAccessForRole}. */
	107	export const memberAccessForRole = (input: OrgRoleInput): ExecutorAccess =>
	108	memberAccess(orgWriteAccessForRole(input));
	109
	110	/**
	111	* A bound member on a session-lifetime stack (MCP sessions): the executor
	112	* outlives any one request, so the workspace-settings decision is read from
	113	* the fiber-local `CurrentOrgWriteAccess` at EVERY guarded sink. The session
	114	* host stamps that reference from each freshly authenticated request, the
	115	* engine re-stamps it from the resuming principal on approval resume, and a
	116	* missing binding fails closed (denied) — a positive authorization is never
	117	* cached for the session lifetime.
	118	*/
	119	export const requestBoundMemberAccess = (): ExecutorAccess => memberPosture(currentOrgWriteAccess);
	120
	121	/**
	122	* The single-user products (local daemon, CLI, desktop, examples): one human
	123	* owns the whole deployment, there is no role model, and the bound subject
	124	* may configure everything.
	125	*/
	126	export const singleUserAccess = (): ExecutorAccess => memberPosture(Effect.succeed("allowed"));
	127
	128	/**
	129	* A subject-less workspace-service binding — boot/system executors that
	130	* converge the tenant's shared state (catalog registration, seeding) with no
	131	* acting member. Sees and writes only the org partition; workspace writes
	132	* are the whole point.
	133	*/
	134	export const workspaceServiceAccess = (): ExecutorAccess => ({
	135	owners: ORG_OWNERS,
	136	settingsWrite: personalOpenSettingsWrite(Effect.succeed("allowed")),
	137	capabilities: memberCapabilities,
	138	toolPolicy: standardToolPolicy(ORG_OWNERS),
	139	});
	140
	141	/**
	142	* The platform observer an org-level credential gets (the `/admin/*` plane):
	143	* subject-less, the WHOLE executor read-only at the storage boundary
	144	* (`storageWrites: "denied"`), and only the `admin` surface reading
	145	* tenant-wide (`adminReads: true`).
	146	*
	147	* `settingsWrite` stays `"allowed"` ON PURPOSE: the platform posture's
	148	* enforcement point is the storage owner policy, which refuses every
	149	* mutation regardless of the surface gate. Deciding `"denied"` here would
	150	* merely swap the failure the (already unreachable-over-HTTP) mutation
	151	* surfaces raise from the storage denial to `OrgWriteDeniedError`; the
	152	* observer's read-only-ness never depends on it.
	153	*/
	154	export const platformObserverAccess = (): ExecutorAccess => ({
	155	owners: ORG_OWNERS,
	156	settingsWrite: personalOpenSettingsWrite(Effect.succeed("allowed")),
	157	capabilities: { adminReads: true, storageWrites: "denied" },
	158	toolPolicy: standardToolPolicy(ORG_OWNERS),
	159	});

packages/core/product-access/src/policy.ts+263−0

@@ -0,0 +1,263 @@
	1	// ---------------------------------------------------------------------------
	2	// The PRODUCT's tool-policy resolution rules — how authored rows and toolkit
	3	// capability rules combine into one `EffectivePolicy`:
	4	//
	5	// - owner-ranked, per-owner first-match by local position;
	6	// - the MOST RESTRICTIVE matched action across owners wins, so a user
	7	// preference cannot weaken an org guardrail (org = outer, user = inner);
	8	// - no authored match falls back to the tool's own `requiresApproval`
	9	// annotation (the plugin default);
	10	// - a list-only toolkit provider is a capability ALLOWLIST: no matching
	11	// rule means the tool is outside the capability boundary and blocks.
	12	//
	13	// Core (`@executor-js/sdk`) never applies these rules itself: it hands the
	14	// rule material to `ExecutorAccess.toolPolicy` and enforces whatever
	15	// `EffectivePolicy` comes back. This module deliberately imports only the
	16	// browser-safe `@executor-js/sdk/shared` utilities (pattern matching, row
	17	// ordering) at runtime, so UI surfaces can preview the same resolution
	18	// without pulling the server SDK.
	19	// ---------------------------------------------------------------------------
	20
	21	import { Effect, Match } from "effect";
	22
	23	import {
	24	comparePolicyRow,
	25	matchPattern,
	26	type EffectivePolicy,
	27	type PolicyMatch,
	28	type ToolPolicy,
	29	} from "@executor-js/sdk/shared";
	30	import type {
	31	StorageFailure,
	32	ToolPolicyEvaluationInput,
	33	ToolPolicyEvaluator,
	34	ToolPolicyProvider,
	35	ToolPolicyProviderRule,
	36	ToolPolicySources,
	37	} from "@executor-js/sdk/core";
	38
	39	/** The stored-row shape resolution reads — structural, so both core's
	40	* persisted `ToolPolicyRow` and UI projections satisfy it. */
	41	export interface ToolPolicyRuleLike {
	42	readonly id: string;
	43	readonly owner: string;
	44	readonly pattern: string;
	45	/** Persisted rows carry a plain string; resolution narrows it. */
	46	readonly action: string;
	47	readonly position: string;
	48	}
	49
	50	const actionRestrictionRank = (action: ToolPolicy["action"]): number =>
	51	Match.value(action).pipe(
	52	Match.when("block", () => 3),
	53	Match.when("require_approval", () => 2),
	54	Match.when("approve", () => 1),
	55	Match.exhaustive,
	56	);
	57
	58	const moreRestrictive = <T extends { readonly action: ToolPolicy["action"] }>(
	59	current: T \| undefined,
	60	candidate: T,
	61	): T => {
	62	if (!current) return candidate;
	63	return actionRestrictionRank(candidate.action) > actionRestrictionRank(current.action)
	64	? candidate
	65	: current;
	66	};
	67
	68	const liftPlugin = (defaultRequiresApproval: boolean \| undefined): EffectivePolicy =>
	69	defaultRequiresApproval
	70	? { action: "require_approval", source: "plugin-default" }
	71	: { action: "approve", source: "plugin-default" };
	72
	73	const liftUser = (match: PolicyMatch): EffectivePolicy => ({
	74	action: match.action,
	75	source: "user",
	76	pattern: match.pattern,
	77	policyId: match.policyId,
	78	});
	79
	80	/**
	81	* Resolve the matching authored rule for one tool id: each owner contributes
	82	* its first matching rule by local position, then the most restrictive
	83	* matched action across owners wins. `ownerRank` orders owners for the
	84	* per-owner scan (the product's precedence); it never weakens the merge.
	85	* Returns undefined when no rule matches.
	86	*/
	87	export const resolveToolPolicy = (
	88	toolId: string,
	89	policies: readonly ToolPolicyRuleLike[],
	90	ownerRank: (row: { readonly owner: string }) => number,
	91	): PolicyMatch \| undefined => {
	92	if (policies.length === 0) return undefined;
	93	const sorted = [...policies].sort((a, b) => {
	94	const sa = ownerRank(a);
	95	const sb = ownerRank(b);
	96	if (sa !== sb) return sa - sb;
	97	return comparePolicyRow(a, b);
	98	});
	99	const firstMatchByOwner = new Map<string, PolicyMatch>();
	100	for (const row of sorted) {
	101	if (firstMatchByOwner.has(row.owner)) continue;
	102	if (matchPattern(row.pattern, toolId)) {
	103	firstMatchByOwner.set(row.owner, {
	104	action: row.action as ToolPolicy["action"],
	105	pattern: row.pattern,
	106	policyId: row.id,
	107	});
	108	}
	109	}
	110	let selected: PolicyMatch \| undefined;
	111	for (const match of firstMatchByOwner.values()) {
	112	selected = moreRestrictive(selected, match);
	113	}
	114	return selected;
	115	};
	116
	117	/**
	118	* {@link resolveToolPolicy} lifted to an {@link EffectivePolicy}: an authored
	119	* match wins, else the plugin default (`requiresApproval` →
	120	* `require_approval`, otherwise `approve`).
	121	*/
	122	export const resolveEffectivePolicy = (
	123	toolId: string,
	124	policies: readonly ToolPolicyRuleLike[],
	125	ownerRank: (row: { readonly owner: string }) => number,
	126	defaultRequiresApproval?: boolean,
	127	): EffectivePolicy => {
	128	const match = resolveToolPolicy(toolId, policies, ownerRank);
	129	return match ? liftUser(match) : liftPlugin(defaultRequiresApproval);
	130	};
	131
	132	/**
	133	* UI-preview variant over an ALREADY-SORTED rule list (a settings page's
	134	* loaded policy list): same per-owner first-match + most-restrictive merge,
	135	* treating rows without an owner as one flat list.
	136	*/
	137	export const effectivePolicyFromSorted = (
	138	toolId: string,
	139	sortedPolicies: readonly (Pick<ToolPolicy, "pattern" \| "action" \| "id"> &
	140	Partial<Pick<ToolPolicy, "owner">>)[],
	141	defaultRequiresApproval?: boolean,
	142	): EffectivePolicy => {
	143	const firstMatchByOwner = new Map<string, EffectivePolicy>();
	144	for (const p of sortedPolicies) {
	145	const ownerKey = "owner" in p && p.owner ? String(p.owner) : "__flat__";
	146	if (firstMatchByOwner.has(ownerKey)) continue;
	147	if (matchPattern(p.pattern, toolId)) {
	148	firstMatchByOwner.set(ownerKey, {
	149	action: p.action,
	150	source: "user",
	151	pattern: p.pattern,
	152	policyId: p.id,
	153	});
	154	}
	155	}
	156	let selected: EffectivePolicy \| undefined;
	157	for (const match of firstMatchByOwner.values()) {
	158	selected = moreRestrictive(selected, match);
	159	}
	160	return selected ?? liftPlugin(defaultRequiresApproval);
	161	};
	162
	163	const compareProviderPolicyRule = (
	164	a: ToolPolicyProviderRule,
	165	b: ToolPolicyProviderRule,
	166	): number => {
	167	if (a.position < b.position) return -1;
	168	if (a.position > b.position) return 1;
	169	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
	170	};
	171
	172	/**
	173	* Resolution for a list-only toolkit provider: first matching rule by
	174	* position wins; NO matching rule blocks — the provider is a capability
	175	* allowlist, and a tool it does not name is outside the boundary.
	176	*/
	177	export const resolveProviderPolicyFromRules = (
	178	toolId: string,
	179	rules: readonly ToolPolicyProviderRule[],
	180	): EffectivePolicy => {
	181	for (const rule of [...rules].sort(compareProviderPolicyRule)) {
	182	if (!matchPattern(rule.pattern, toolId)) continue;
	183	return {
	184	action: rule.action,
	185	source: "user",
	186	pattern: rule.pattern,
	187	policyId: rule.id,
	188	};
	189	}
	190	return {
	191	action: "block",
	192	source: "user",
	193	pattern: "*",
	194	};
	195	};
	196
	197	/**
	198	* The standard product implementation of `ExecutorAccess.toolPolicy`.
	199	*
	200	* With a plugin-registered provider (a toolkit session), the provider's own
	201	* batched `prepare` / per-tool `resolve` / plain `list` allowlist governs.
	202	* Otherwise the stored owner-scoped rows resolve under the binding's owner
	203	* precedence with the most-restrictive merge and plugin-default fallback.
	204	*/
	205	export const standardToolPolicy =
	206	(owners: readonly string[]) =>
	207	(sources: ToolPolicySources): Effect.Effect<ToolPolicyEvaluator, StorageFailure> => {
	208	const provider: ToolPolicyProvider \| null = sources.provider;
	209	if (provider) {
	210	if (provider.prepare) {
	211	// Batched per-operation resolver: fetch all policy + connection
	212	// state once, resolve every tool in the operation from the snapshot.
	213	return provider.prepare().pipe(
	214	Effect.map(
	215	(resolve): ToolPolicyEvaluator => ({
	216	resolve: (input: ToolPolicyEvaluationInput) =>
	217	Effect.succeed(
	218	resolve({
	219	toolId: input.toolId,
	220	...(input.defaultRequiresApproval === undefined
	221	? {}
	222	: { defaultRequiresApproval: input.defaultRequiresApproval }),
	223	}),
	224	),
	225	}),
	226	),
	227	);
	228	}
	229	const perTool = provider.resolve;
	230	if (perTool) {
	231	return Effect.succeed({
	232	resolve: (input: ToolPolicyEvaluationInput) =>
	233	perTool({
	234	toolId: input.toolId,
	235	...(input.defaultRequiresApproval === undefined
	236	? {}
	237	: { defaultRequiresApproval: input.defaultRequiresApproval }),
	238	}),
	239	});
	240	}
	241	return provider.list().pipe(
	242	Effect.map(
	243	(rules): ToolPolicyEvaluator => ({
	244	resolve: (input) => Effect.succeed(resolveProviderPolicyFromRules(input.toolId, rules)),
	245	}),
	246	),
	247	);
	248	}
	249	const ownerRank = (row: { readonly owner: string }): number => {
	250	const rank = owners.indexOf(row.owner);
	251	return rank === -1 ? owners.length : rank;
	252	};
	253	return sources.policyRows.pipe(
	254	Effect.map(
	255	(rows): ToolPolicyEvaluator => ({
	256	resolve: (input) =>
	257	Effect.succeed(
	258	resolveEffectivePolicy(input.toolId, rows, ownerRank, input.defaultRequiresApproval),
	259	),
	260	}),
	261	),
	262	);
	263	};

packages/core/product-access/src/testing.ts+54−0

@@ -0,0 +1,54 @@
	1	// ---------------------------------------------------------------------------
	2	// Explicit product-access postures for tests. These are the PRODUCTION rules
	3	// from ./index, packaged so a test states its posture at the call site —
	4	// `makeTestConfig` (from `@executor-js/sdk/testing`) has no default posture.
	5	//
	6	// `@executor-js/sdk`'s OWN tests import this entry too — resolved through
	7	// the workspace ROOT devDependency on `@executor-js/product-access`, not
	8	// through the sdk package itself, which declares no dependency on this
	9	// package. That keeps the package graph acyclic (turbo rejects even
	10	// dev-dependency cycles) while every test states a real product posture.
	11	// ---------------------------------------------------------------------------
	12
	13	import { Effect } from "effect";
	14
	15	import type { ExecutorAccess, OrgWriteAccess } from "@executor-js/sdk/core";
	16
	17	import {
	18	memberAccess,
	19	platformObserverAccess,
	20	requestBoundMemberAccess,
	21	workspaceServiceAccess,
	22	} from "./index";
	23
	24	/** Explicit product postures for test bindings. */
	25	export const testAccess = {
	26	/** A bound member with a static workspace-settings decision. */
	27	member: (workspaceWrites: OrgWriteAccess = "allowed"): ExecutorAccess =>
	28	memberAccess(workspaceWrites),
	29	/** A bound member on a session-lifetime stack: the decision is read from
	30	* the fiber-local `CurrentOrgWriteAccess` at every guarded sink. */
	31	requestBound: (): ExecutorAccess => requestBoundMemberAccess(),
	32	/** A subject-less workspace-service binding (org partition only), with an
	33	* optional denied workspace-settings decision for boot-convergence
	34	* scenarios. */
	35	org: (workspaceWrites: OrgWriteAccess = "allowed"): ExecutorAccess => {
	36	const base = workspaceServiceAccess();
	37	if (workspaceWrites === "allowed") return base;
	38	return {
	39	...base,
	40	settingsWrite: (target) =>
	41	Effect.succeed(target.kind === "owner" && target.owner === "user" ? "allowed" : "denied"),
	42	};
	43	},
	44	/** The platform observer posture; `subject: false` is the production
	45	* subject-less shape, the default keeps a bound subject's partitions for
	46	* tests that combine a member binding with the platform capabilities. */
	47	platform: (options?: { readonly subject?: boolean }): ExecutorAccess =>
	48	options?.subject === false
	49	? platformObserverAccess()
	50	: {
	51	...platformObserverAccess(),
	52	owners: ["user", "org"],
	53	},
	54	} as const;

packages/core/product-access/tsconfig.json+27−0

@@ -0,0 +1,27 @@
	1	{
	2	"compilerOptions": {
	3	"target": "ES2022",
	4	"module": "ESNext",
	5	"moduleResolution": "Bundler",
	6	"strict": true,
	7	"skipLibCheck": true,
	8	"outDir": "dist",
	9	"rootDir": "src",
	10	"declaration": true,
	11	"declarationMap": true,
	12	"sourceMap": true,
	13	"lib": ["ES2022"],
	14	"types": ["bun-types", "node"],
	15	"noUnusedLocals": true,
	16	"noImplicitOverride": true,
	17	"plugins": [
	18	{
	19	"name": "@effect/language-service",
	20	"ignoreEffectSuggestionsInTscExitCode": true,
	21	"ignoreEffectWarningsInTscExitCode": true,
	22	"diagnosticSeverity": {}
	23	}
	24	]
	25	},
	26	"include": ["src/*/.ts"]
	27	}

packages/core/product-access/tsup.config.ts+14−0

@@ -0,0 +1,14 @@
	1	import { defineConfig } from "tsup";
	2
	3	export default defineConfig({
	4	entry: {
	5	index: "src/index.ts",
	6	policy: "src/policy.ts",
	7	testing: "src/testing.ts",
	8	},
	9	format: ["esm"],
	10	dts: false,
	11	sourcemap: true,
	12	clean: true,
	13	external: [/^@executor-js\//, /^effect/, /^@effect\//],
	14	});

packages/core/product-access/vitest.config.ts+7−0

@@ -0,0 +1,7 @@
	1	import { defineConfig } from "vitest/config";
	2
	3	export default defineConfig({
	4	test: {
	5	include: ["src/*/.test.ts"],
	6	},
	7	});

packages/core/sdk/README.md+14−3

 ## Install
 ```sh
-bun add @executor-js/sdk
+bun add @executor-js/sdk @executor-js/product-access effect@4.0.0-beta.59
 # or
-npm install @executor-js/sdk
+npm install @executor-js/sdk @executor-js/product-access effect@4.0.0-beta.59
 ```
+`effect` is a required peer dependency (some package managers don't install peers automatically). `@executor-js/product-access` supplies the standard `access` postures `createExecutor` requires — every snippet below uses it.
 ## Quick start
 ```ts
+import { workspaceServiceAccess } from "@executor-js/product-access";
 import { createExecutor } from "@executor-js/sdk";
 const executor = await createExecutor({
   // `"accept-all"` auto-approves every prompt — fine for tests/automation.
   // For an interactive host, pass a handler `(ctx) => Promise<ElicitationResponse>`.
   onElicitation: "accept-all",
+  // Required: the product's access decisions for this binding. The SDK ships
+  // no default posture; `@executor-js/product-access` has the standard ones.
+  access: workspaceServiceAccess(),
 });
 const tools = await executor.tools.list();
 To invoke a tool once one is registered:
 ```ts
+import { workspaceServiceAccess } from "@executor-js/product-access";
 import { createExecutor } from "@executor-js/sdk";
-const executor = await createExecutor({ onElicitation: "accept-all" });
+const executor = await createExecutor({
+  onElicitation: "accept-all",
+  access: workspaceServiceAccess(),
+});
 const tools = await executor.tools.list();
 const target = tools[0];
 const executor = await createExecutor({
   plugins: [memorySecretsPlugin({ initial: { greeting: "hello" } })] as const,
   onElicitation: "accept-all",
+  access: workspaceServiceAccess(),
 });
 console.log(executor.memorySecrets.label); // "in-memory secrets"

packages/core/sdk/src/access.test.ts+370−0

@@ -0,0 +1,370 @@
	1	// ---------------------------------------------------------------------------
	2	// ExecutorAccess — the product/core boundary itself.
	3	//
	4	// `createExecutor` requires an access value, validates it against the
	5	// binding, and ENFORCES its decisions without owning any of them. These
	6	// tests pin the contract with the REAL product implementations
	7	// (@executor-js/product-access, resolved via the workspace root
	8	// devDependency):
	9	// - a malformed access fails the boot loudly;
	10	// - the settings decision is consulted live, never snapshotted;
	11	// - `owners` really filters storage CRUD and the tool surfaces (org-only
	12	// and personal-only views included — core forces no partition);
	13	// - the `toolPolicy` hook is the ONLY policy authority core consults;
	14	// - the tenant clamp holds even under an over-permissive access.
	15	// ---------------------------------------------------------------------------
	16
	17	import { describe, expect, it } from "@effect/vitest";
	18	import { Effect, Ref } from "effect";
	19
	20	import { standardToolPolicy } from "@executor-js/product-access/policy";
	21	import { testAccess } from "@executor-js/product-access/testing";
	22
	23	import { executorAccessViolation, type ExecutorAccess } from "./access";
	24	import { createExecutor } from "./executor";
	25	import {
	26	AuthTemplateSlug,
	27	ConnectionName,
	28	IntegrationSlug,
	29	ProviderItemId,
	30	ProviderKey,
	31	Tenant,
	32	ToolAddress,
	33	ToolName,
	34	} from "./ids";
	35	import { definePlugin } from "./plugin";
	36	import type { CredentialProvider } from "./provider";
	37	import { makeTestConfig } from "./testing";
	38
	39	const memberShaped: ExecutorAccess = testAccess.member();
	40
	41	/** A subject-bound binding whose product view is PERSONAL-ONLY — no
	42	* production posture ships this shape yet, which is exactly the point: the
	43	* contract must carry it without core forcing the org partition back in. */
	44	const personalOnlyAccess = (): ExecutorAccess => ({
	45	...testAccess.member(),
	46	owners: ["user"],
	47	toolPolicy: standardToolPolicy(["user"]),
	48	});
	49
	50	/** An org-only view for a subject-BOUND member (narrower than identity). */
	51	const orgOnlyMemberAccess = (): ExecutorAccess => ({
	52	...testAccess.member(),
	53	owners: ["org"],
	54	toolPolicy: standardToolPolicy(["org"]),
	55	});
	56
	57	const memoryProvider = (): CredentialProvider => {
	58	const store = new Map<string, string>();
	59	return {
	60	key: ProviderKey.make("memory"),
	61	writable: true,
	62	get: (id) => Effect.sync(() => store.get(String(id)) ?? null),
	63	set: (id, value) => Effect.sync(() => void store.set(String(id), value)),
	64	delete: (id) => Effect.sync(() => void store.delete(String(id))),
	65	has: (id) => Effect.sync(() => store.has(String(id))),
	66	list: () =>
	67	Effect.sync(() =>
	68	Array.from(store.keys()).map((key) => ({ id: ProviderItemId.make(key), name: key })),
	69	),
	70	};
	71	};
	72
	73	const INTEG = IntegrationSlug.make("vercel");
	74	const TEMPLATE = AuthTemplateSlug.make("apiKey");
	75
	76	const demoPlugin = definePlugin(() => ({
	77	id: "demo" as const,
	78	credentialProviders: [memoryProvider()],
	79	storage: () => ({}),
	80	resolveTools: () =>
	81	Effect.succeed({ tools: [{ name: ToolName.make("deploy"), description: "deploy" }] }),
	82	invokeTool: ({ toolRow }) => Effect.succeed({ ran: toolRow.name }),
	83	extension: (ctx) => ({
	84	seed: () => ctx.core.integrations.register({ slug: INTEG, description: "Vercel", config: {} }),
	85	}),
	86	}))();
	87
	88	/** Seed one org and one user connection (with their tools) plus one org and
	89	* one user policy row, through a full-view member executor. */
	90	const seedWorkspace = Effect.fn("seedWorkspace")(function* (
	91	config: ReturnType<typeof makeTestConfig<readonly [typeof demoPlugin]>>,
	92	) {
	93	const admin = yield* createExecutor(config);
	94	yield* Effect.addFinalizer(() => admin.close().pipe(Effect.ignore));
	95	yield* admin.demo.seed();
	96	yield* admin.connections.create({
	97	owner: "org",
	98	name: ConnectionName.make("shared"),
	99	integration: INTEG,
	100	template: TEMPLATE,
	101	value: "org-token",
	102	});
	103	yield* admin.connections.create({
	104	owner: "user",
	105	name: ConnectionName.make("mine"),
	106	integration: INTEG,
	107	template: TEMPLATE,
	108	value: "user-token",
	109	});
	110	yield* admin.policies.create({ owner: "org", pattern: "github.*", action: "block" });
	111	yield* admin.policies.create({ owner: "user", pattern: "linear.*", action: "approve" });
	112	return admin;
	113	});
	114
	115	describe("executorAccessViolation", () => {
	116	it("accepts the production postures against their bindings", () => {
	117	expect(executorAccessViolation(memberShaped, "subject-1")).toBeNull();
	118	expect(executorAccessViolation(testAccess.org(), null)).toBeNull();
	119	expect(executorAccessViolation(testAccess.platform({ subject: false }), null)).toBeNull();
	120	// Personal-only is a VALID product shape: core mandates no partition.
	121	expect(executorAccessViolation(personalOnlyAccess(), "subject-1")).toBeNull();
	122	});
	123
	124	it("rejects an empty owners list", () => {
	125	expect(executorAccessViolation({ ...memberShaped, owners: [] }, "subject-1")).toContain(
	126	"must not be empty",
	127	);
	128	});
	129
	130	it("rejects a duplicated owner", () => {
	131	expect(executorAccessViolation({ ...memberShaped, owners: ["user", "user"] }, "s")).toContain(
	132	"repeat",
	133	);
	134	});
	135
	136	it("rejects a user partition on a subject-less binding", () => {
	137	expect(executorAccessViolation(memberShaped, null)).toContain("no subject");
	138	});
	139	});
	140
	141	describe("createExecutor access validation", () => {
	142	it.effect("fails the boot when the access does not fit the binding", () =>
	143	Effect.gen(function* () {
	144	const config = makeTestConfig({ access: testAccess.org(), subject: null });
	145	const error = yield* Effect.flip(
	146	// member-shaped access (user partition) on a subject-less binding.
	147	createExecutor({ ...config, access: testAccess.member() }),
	148	);
	149	expect(error).toMatchObject({
	150	_tag: "StorageError",
	151	message: expect.stringContaining("no subject"),
	152	});
	153	}),
	154	);
	155	});
	156
	157	describe("settingsWrite is consulted live", () => {
	158	it.effect("a flipped decision applies to the next guarded call, not a snapshot", () =>
	159	Effect.gen(function* () {
	160	const decision = yield* Ref.make<"allowed" \| "denied">("allowed");
	161	const config = makeTestConfig({
	162	access: {
	163	...testAccess.member(),
	164	settingsWrite: (target) =>
	165	target.kind === "owner" && target.owner === "user"
	166	? Effect.succeed("allowed" as const)
	167	: Ref.get(decision),
	168	},
	169	});
	170	const executor = yield* createExecutor(config);
	171	yield* Effect.addFinalizer(() => executor.close().pipe(Effect.ignore));
	172
	173	const created = yield* executor.policies.create({
	174	owner: "org",
	175	pattern: "vercel.*",
	176	action: "block",
	177	});
	178	expect(created.pattern).toBe("vercel.*");
	179
	180	yield* Ref.set(decision, "denied");
	181	const error = yield* Effect.flip(
	182	executor.policies.create({ owner: "org", pattern: "github.*", action: "block" }),
	183	);
	184	expect(error).toMatchObject({ _tag: "OrgWriteDeniedError" });
	185
	186	// Personal-scope writes stay open under the denied decision.
	187	const personal = yield* executor.policies.create({
	188	owner: "user",
	189	pattern: "linear.*",
	190	action: "approve",
	191	});
	192	expect(personal.owner).toBe("user");
	193	}).pipe(Effect.scoped),
	194	);
	195	});
	196
	197	describe("owners really filters storage and tool surfaces", () => {
	198	it.effect("an org-only member view sees no user rows anywhere", () =>
	199	Effect.gen(function* () {
	200	const config = makeTestConfig({
	201	access: testAccess.member(),
	202	plugins: [demoPlugin] as const,
	203	});
	204	yield* seedWorkspace(config);
	205
	206	const orgOnly = yield* createExecutor({ ...config, access: orgOnlyMemberAccess() });
	207	yield* Effect.addFinalizer(() => orgOnly.close().pipe(Effect.ignore));
	208
	209	const policies = yield* orgOnly.policies.list();
	210	expect(policies.map((p) => p.owner)).toEqual(["org"]);
	211
	212	const connections = yield* orgOnly.connections.list();
	213	expect(connections.map((c) => `${c.owner}:${c.name}`)).toEqual(["org:shared"]);
	214
	215	const tools = yield* orgOnly.tools.list();
	216	const dynamic = tools.filter((t) => !t.static);
	217	expect(dynamic.map((t) => `${t.owner}:${t.connection}`)).toEqual(["org:shared"]);
	218
	219	// The excluded partition is not writable either: the settings gate
	220	// (personal stays open) passes, and the STORAGE clamp refuses.
	221	const error = yield* Effect.flip(
	222	orgOnly.policies.create({ owner: "user", pattern: "x.*", action: "approve" }),
	223	);
	224	expect(error).toMatchObject({
	225	_tag: "StorageError",
	226	message: expect.stringContaining("does not include"),
	227	});
	228	}).pipe(Effect.scoped),
	229	);
	230
	231	it.effect("a personal-only view sees no org rows anywhere", () =>
	232	Effect.gen(function* () {
	233	const config = makeTestConfig({
	234	access: testAccess.member(),
	235	plugins: [demoPlugin] as const,
	236	});
	237	yield* seedWorkspace(config);
	238
	239	const personal = yield* createExecutor({ ...config, access: personalOnlyAccess() });
	240	yield* Effect.addFinalizer(() => personal.close().pipe(Effect.ignore));
	241
	242	const policies = yield* personal.policies.list();
	243	expect(policies.map((p) => p.owner)).toEqual(["user"]);
	244
	245	const connections = yield* personal.connections.list();
	246	expect(connections.map((c) => `${c.owner}:${c.name}`)).toEqual(["user:mine"]);
	247
	248	const tools = yield* personal.tools.list();
	249	const dynamic = tools.filter((t) => !t.static);
	250	expect(dynamic.map((t) => `${t.owner}:${t.connection}`)).toEqual(["user:mine"]);
	251
	252	// Invoking a tool over the hidden org connection fails as not-found —
	253	// the row is invisible, not merely blocked.
	254	const invokeError = yield* Effect.flip(
	255	personal.execute(ToolAddress.make(`tools.${INTEG}.org.shared.deploy`), {}),
	256	);
	257	expect(invokeError).toMatchObject({ _tag: "ToolNotFoundError" });
	258
	259	// Shared-catalog (org-partition) writes refuse loudly at storage.
	260	const writeError = yield* Effect.flip(
	261	personal.policies.create({ owner: "org", pattern: "x.*", action: "block" }),
	262	);
	263	expect(writeError).toMatchObject({
	264	_tag: "StorageError",
	265	message: expect.stringContaining("does not include"),
	266	});
	267	}).pipe(Effect.scoped),
	268	);
	269	});
	270
	271	describe("the product toolPolicy hook is the only policy authority", () => {
	272	it.effect("a hook that blocks everything gates execute and list, whatever rows say", () =>
	273	Effect.gen(function* () {
	274	const config = makeTestConfig({
	275	access: testAccess.member(),
	276	plugins: [demoPlugin] as const,
	277	});
	278	yield* seedWorkspace(config);
	279
	280	const blockAll: ExecutorAccess = {
	281	...testAccess.member(),
	282	toolPolicy: () =>
	283	Effect.succeed({
	284	resolve: () =>
	285	Effect.succeed({ action: "block" as const, source: "user" as const, pattern: "*" }),
	286	}),
	287	};
	288	const executor = yield* createExecutor({ ...config, access: blockAll });
	289	yield* Effect.addFinalizer(() => executor.close().pipe(Effect.ignore));
	290
	291	const tools = yield* executor.tools.list();
	292	expect(tools.filter((t) => !t.static)).toHaveLength(0);
	293	const error = yield* Effect.flip(
	294	executor.execute(ToolAddress.make(`tools.${INTEG}.org.shared.deploy`), {}),
	295	);
	296	expect(error).toMatchObject({ _tag: "ToolBlockedError" });
	297	}).pipe(Effect.scoped),
	298	);
	299
	300	it.effect("a hook that approves everything overrides a stored org block", () =>
	301	Effect.gen(function* () {
	302	const config = makeTestConfig({
	303	access: testAccess.member(),
	304	plugins: [demoPlugin] as const,
	305	});
	306	const admin = yield* seedWorkspace(config);
	307	// A stored rule that would block the tool under the standard product
	308	// resolution — proving core itself never consults the rows.
	309	yield* admin.policies.create({ owner: "org", pattern: "*", action: "block" });
	310
	311	const approveAll: ExecutorAccess = {
	312	...testAccess.member(),
	313	toolPolicy: () =>
	314	Effect.succeed({
	315	resolve: () =>
	316	Effect.succeed({
	317	action: "approve" as const,
	318	source: "plugin-default" as const,
	319	}),
	320	}),
	321	};
	322	const executor = yield* createExecutor({ ...config, access: approveAll });
	323	yield* Effect.addFinalizer(() => executor.close().pipe(Effect.ignore));
	324
	325	const result = yield* executor.execute(
	326	ToolAddress.make(`tools.${INTEG}.org.shared.deploy`),
	327	{},
	328	);
	329	expect(result).toMatchObject({ ran: "deploy" });
	330	}).pipe(Effect.scoped),
	331	);
	332	});
	333
	334	describe("tenant clamp is not product-configurable", () => {
	335	it.effect("an over-permissive access never reads another tenant's rows", () =>
	336	Effect.gen(function* () {
	337	const config = makeTestConfig({
	338	access: testAccess.member(),
	339	plugins: [demoPlugin] as const,
	340	});
	341	yield* seedWorkspace(config);
	342
	343	// Same database, different tenant, maximally permissive product view.
	344	const intruder = yield* createExecutor({
	345	...config,
	346	tenant: Tenant.make("other-tenant"),
	347	access: {
	348	...testAccess.member(),
	349	toolPolicy: () =>
	350	Effect.succeed({
	351	resolve: () =>
	352	Effect.succeed({
	353	action: "approve" as const,
	354	source: "plugin-default" as const,
	355	}),
	356	}),
	357	},
	358	});
	359	yield* Effect.addFinalizer(() => intruder.close().pipe(Effect.ignore));
	360
	361	expect(yield* intruder.policies.list()).toHaveLength(0);
	362	expect(yield* intruder.connections.list()).toHaveLength(0);
	363	expect((yield* intruder.tools.list()).filter((t) => !t.static)).toHaveLength(0);
	364	const error = yield* Effect.flip(
	365	intruder.execute(ToolAddress.make(`tools.${INTEG}.org.shared.deploy`), {}),
	366	);
	367	expect(error).toMatchObject({ _tag: "ToolNotFoundError" });
	368	}).pipe(Effect.scoped),
	369	);
	370	});

packages/core/sdk/src/access.ts+215−0

@@ -0,0 +1,215 @@
	1	import { Context, Effect, Ref } from "effect";
	2
	3	import type { ToolPolicyRow } from "./core-schema";
	4	import type { StorageFailure } from "./fuma-runtime";
	5	import type { Owner } from "./ids";
	6	import type { ToolPolicyProvider } from "./plugin";
	7	import type { EffectivePolicy } from "./policies";
	8
	9	// ---------------------------------------------------------------------------
	10	// Product access — the defined interface through which the PRODUCT hands the
	11	// executor its personal/organization access decisions.
	12	//
	13	// Core deliberately owns no product rule here: it does not know what a role
	14	// is, which member is an admin, or why a deployment has no role model at all.
	15	// Core defines the decision vocabulary (this module), consults the supplied
	16	// decisions at its enforcement sinks, and keeps enforcing the security
	17	// invariants that are NOT product-configurable: tenant isolation and the
	18	// storage owner policy (owner-policy.ts), which clamp whatever the product
	19	// supplies. `ExecutorConfig.access` is required — there is no default posture
	20	// in core, so every composition root states its product's rules explicitly.
	21	// ---------------------------------------------------------------------------
	22
	23	/** Workspace-settings authorization bound to the currently executing request. */
	24	export type OrgWriteAccess = "allowed" \| "denied";
	25
	26	/** A single product authorization answer core enforces verbatim. */
	27	export type AccessDecision = "allowed" \| "denied";
	28
	29	/**
	30	* The target of a user-intent settings mutation, as core describes it to the
	31	* product's {@link ExecutorAccess.settingsWrite} rule:
	32	*
	33	* - `{ kind: "owner", owner }` — an owner-scoped settings row (a connection,
	34	* tool policy, OAuth client, …) filed under that partition.
	35	* - `{ kind: "workspace" }` — a tenant-shared surface (the integration
	36	* catalog and other whole-workspace settings).
	37	*/
	38	export type SettingsWriteTarget =
	39	\| { readonly kind: "owner"; readonly owner: Owner }
	40	\| { readonly kind: "workspace" };
	41
	42	/**
	43	* Structural view capabilities the product grants a binding. Core maps each
	44	* to a non-overridable mechanism:
	45	*
	46	* - `adminReads` — expose `executor.admin`, the ONLY surface whose reads are
	47	* tenant-wide. The widened context is read-only by construction
	48	* (owner-policy reach mechanics), regardless of what the product says.
	49	* - `storageWrites` — `"denied"` makes the WHOLE executor read-only at the
	50	* storage boundary (every create/update/delete on every guarded table is
	51	* refused, and catalog re-sync is skipped). The platform observer posture
	52	* combines both.
	53	*/
	54	export interface ExecutorAccessCapabilities {
	55	readonly adminReads: boolean;
	56	readonly storageWrites: AccessDecision;
	57	}
	58
	59	/** One effective-policy question, as core asks the product's evaluator. */
	60	export interface ToolPolicyEvaluationInput {
	61	/** Normalized policy id: a static tool's address, or the 4-segment
	62	* `<integration>.<owner>.<connection>.<tool>` form. */
	63	readonly toolId: string;
	64	/** The tool's own `requiresApproval` annotation — the fallback material a
	65	* product resolution may lift when no authored rule matches. */
	66	readonly defaultRequiresApproval?: boolean \| undefined;
	67	}
	68
	69	/**
	70	* A per-operation effective-policy evaluator returned by
	71	* {@link ExecutorAccess.toolPolicy}. Built once per surface operation (one
	72	* tools list / schema read / invocation / post-approval recheck) so a product
	73	* implementation can batch its underlying reads; `resolve` is then asked once
	74	* per tool. Core ENFORCES whatever comes back — `block` refuses the call,
	75	* `require_approval` gates it behind an elicitation — but never decides it.
	76	*/
	77	export interface ToolPolicyEvaluator {
	78	readonly resolve: (
	79	input: ToolPolicyEvaluationInput,
	80	) => Effect.Effect<EffectivePolicy, StorageFailure>;
	81	}
	82
	83	/**
	84	* The rule material core hands the product's {@link ExecutorAccess.toolPolicy}
	85	* hook for one operation. Both members are the product's to consult or
	86	* ignore; core pre-selects nothing.
	87	*/
	88	export interface ToolPolicySources {
	89	/**
	90	* The stored, owner-scoped `tool_policy` rows visible to this binding —
	91	* a LAZY effect, fetched only if the product's resolution reads it.
	92	*/
	93	readonly policyRows: Effect.Effect<readonly ToolPolicyRow[], StorageFailure>;
	94	/**
	95	* The plugin-registered policy provider, when a plugin opted this executor
	96	* instance into a session rule source (a toolkit's capability set), else
	97	* null. Toolkit sessions also hide catalog entries that grant no tools;
	98	* that presentation follows the provider's presence (part of the
	99	* `ToolPolicyProvider` plugin contract), while HOW its rules resolve —
	100	* including the empty-match default — is decided here, by the product.
	101	*/
	102	readonly provider: ToolPolicyProvider \| null;
	103	}
	104
	105	/**
	106	* Product-owned access decisions for one executor binding. Supplied by the
	107	* host's composition root (see `@executor-js/product-access` for the product
	108	* rule implementations); enforced — never decided — by core.
	109	*
	110	* Shape invariants, validated at `createExecutor` (violations fail the boot):
	111	* - `owners` is a non-empty, duplicate-free subset of `["user", "org"]`;
	112	* - `"user"` may appear only when the executor binds a subject.
	113	*
	114	* Core's non-overridable clamps apply to every decision: the tenant clause
	115	* is never relaxed, user rows only ever resolve to the bound subject,
	116	* tenant-reach contexts are read-only (or delete-only, for the internal
	117	* removal cascade), and a mid-run tool is never interrupted by a policy
	118	* change — `block` means "don't start new runs".
	119	*
	120	* PAUSED EXECUTIONS: a pause/resume boundary re-evaluates the
	121	* request-bound `settingsWrite` decision as the RESUMING principal (via
	122	* {@link CurrentOrgWriteAccess}), and the post-approval recheck re-resolves
	123	* the tool policy and re-reads rows — but storage reads and credential
	124	* resolution still run under the STARTER's binding, whose executor instance
	125	* owns the paused fiber.
	126	*/
	127	export interface ExecutorAccess {
	128	/**
	129	* ROW VISIBILITY AND WRITE AUTHORIZATION: the owner partitions this
	130	* binding sees and may write, in precedence order (the first entry shadows
	131	* later ones on plugin-storage reads, ranks first in policy listings, and
	132	* is the partition static tools present under). Carried onto every storage
	133	* context: reads, updates and deletes are FILTERED to these partitions and
	134	* creates outside them are refused — an org-only or personal-only product
	135	* view really is one, across storage CRUD and the tool surfaces built on
	136	* it. Core contributes no partition of its own.
	137	*/
	138	readonly owners: readonly Owner[];
	139	/**
	140	* USER-INTENT SETTINGS AUTHORIZATION, including the owner-target rule.
	141	* Consulted live at every guarded sink (never cached by core, so a
	142	* request-bound implementation is re-read after pauses and on resume);
	143	* `"denied"` surfaces as `OrgWriteDeniedError`. Operational writes a
	144	* denied member's usage implies (token refresh, catalog re-sync) do not
	145	* pass through this gate — they are bounded by `owners` and the storage
	146	* clamps instead.
	147	*/
	148	readonly settingsWrite: (target: SettingsWriteTarget) => Effect.Effect<AccessDecision>;
	149	/** View capabilities — see {@link ExecutorAccessCapabilities}. */
	150	readonly capabilities: ExecutorAccessCapabilities;
	151	/**
	152	* EFFECTIVE TOOL-POLICY EVALUATION. Called once per surface operation with
	153	* this binding's rule material; the returned evaluator answers every
	154	* per-tool question in that operation. Owner ranking, cross-owner merging,
	155	* plugin-default fallback and the capability-allowlist default all live in
	156	* the product implementation.
	157	*/
	158	readonly toolPolicy: (
	159	sources: ToolPolicySources,
	160	) => Effect.Effect<ToolPolicyEvaluator, StorageFailure>;
	161	}
	162
	163	/**
	164	* Validate an {@link ExecutorAccess} against the executor's `{ tenant,
	165	* subject }` binding. Returns null when well-formed; a violation is a
	166	* programmer error at a composition root and fails fast via the returned
	167	* message so `createExecutor` can surface it as a startup failure.
	168	*/
	169	export const executorAccessViolation = (
	170	access: ExecutorAccess,
	171	subject: string \| null,
	172	): string \| null => {
	173	const owners = access.owners;
	174	if (owners.length === 0) return "ExecutorAccess.owners must not be empty.";
	175	if (new Set(owners).size !== owners.length) {
	176	return "ExecutorAccess.owners must not repeat an owner.";
	177	}
	178	if (owners.includes("user") && subject == null) {
	179	return 'ExecutorAccess.owners includes "user" but the executor has no subject.';
	180	}
	181	return null;
	182	};
	183
	184	/**
	185	* Fiber-local workspace-settings authorization for request-bound executors.
	186	*
	187	* This is the decision CARRIER, not a decision rule: a session host stamps it
	188	* from each freshly authenticated request, the execution engine snapshots the
	189	* state onto a paused execution and re-stamps `current` from the resuming (or
	190	* joining) principal's fiber, and a request-bound `ExecutorAccess`
	191	* implementation reads it at every guarded sink. The denied default makes a
	192	* missing request binding fail closed. Executors whose product supplies a
	193	* static decision never consult this reference.
	194	*/
	195	export interface OrgWriteAccessState {
	196	/** Mutable value inherited by a detached execution and refreshed on resume. */
	197	readonly current: Ref.Ref<OrgWriteAccess>;
	198	}
	199
	200	/** Create an isolated request/execution authorization state. */
	201	export const makeOrgWriteAccessState = (access: OrgWriteAccess): OrgWriteAccessState => ({
	202	current: Ref.makeUnsafe(access),
	203	});
	204
	205	/** Request-local workspace-write authorization inherited by child fibers. */
	206	export const CurrentOrgWriteAccess = Context.Reference<OrgWriteAccessState>(
	207	"@executor-js/sdk/CurrentOrgWriteAccess",
	208	{ defaultValue: () => makeOrgWriteAccessState("denied") },
	209	);
	210
	211	/** Read the effective authorization at a workspace-write sink. */
	212	export const currentOrgWriteAccess: Effect.Effect<OrgWriteAccess> = Effect.gen(function* () {
	213	const state = yield* CurrentOrgWriteAccess;
	214	return yield* Ref.get(state.current);
	215	});

packages/core/sdk/src/approval-access-recheck.test.ts+138−0

@@ -0,0 +1,138 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { Effect, Ref, Schema } from "effect";
	3
	4	import { ElicitationResponse } from "./elicitation";
	5	import { AuthTemplateSlug, ConnectionName, IntegrationSlug, ToolAddress, ToolName } from "./ids";
	6	import { definePlugin, tool } from "./plugin";
	7	import { makeTestExecutor, memoryCredentialsPlugin } from "./testing";
	8	import { testAccess } from "@executor-js/product-access/testing";
	9
	10	const integration = IntegrationSlug.make("approvalcheck");
	11	const connection = ConnectionName.make("main");
	12	const staticAddress = ToolAddress.make("approvalcheck.control.run");
	13	const dynamicAddress = ToolAddress.make("tools.approvalcheck.org.main.run");
	14
	15	const setup = Effect.gen(function* () {
	16	const invocations = yield* Ref.make(0);
	17	const recordInvocation = Ref.update(invocations, (count) => count + 1).pipe(
	18	Effect.as("executed"),
	19	);
	20	const plugin = definePlugin(() => ({
	21	id: "approval-check" as const,
	22	storage: () => ({}),
	23	staticIntegrations: () => [
	24	{
	25	id: "approvalcheck.control",
	26	kind: "control" as const,
	27	name: "Approval check",
	28	tools: [
	29	tool({
	30	name: "run",
	31	description: "Record an invocation after approval.",
	32	annotations: { requiresApproval: true },
	33	inputSchema: Schema.toStandardSchemaV1(
	34	Schema.toStandardJSONSchemaV1(Schema.Struct({})),
	35	),
	36	execute: () => recordInvocation,
	37	}),
	38	],
	39	},
	40	],
	41	resolveTools: () =>
	42	Effect.succeed({
	43	tools: [
	44	{
	45	name: ToolName.make("run"),
	46	description: "Record an invocation after approval.",
	47	annotations: { requiresApproval: true },
	48	},
	49	],
	50	}),
	51	invokeTool: () => recordInvocation,
	52	extension: (ctx) => ({
	53	register: () =>
	54	ctx.core.integrations.register({
	55	slug: integration,
	56	description: "Approval check",
	57	config: {},
	58	}),
	59	}),
	60	}));
	61	const executor = yield* makeTestExecutor({
	62	access: testAccess.member(),
	63	plugins: [plugin(), memoryCredentialsPlugin()] as const,
	64	});
	65	yield* executor["approval-check"].register();
	66	yield* executor.connections.create({
	67	owner: "org",
	68	integration,
	69	name: connection,
	70	template: AuthTemplateSlug.make("none"),
	71	value: "synthetic-approval-test-key",
	72	});
	73	return { executor, invocations };
	74	});
	75
	76	describe("access changes while approval is pending", () => {
	77	for (const address of [staticAddress, dynamicAddress]) {
	78	it.effect(`blocks ${address} if policy changes before acceptance`, () =>
	79	Effect.gen(function* () {
	80	const { executor, invocations } = yield* setup;
	81	const error = yield* Effect.flip(
	82	executor.execute(
	83	address,
	84	{},
	85	{
	86	onElicitation: () =>
	87	executor.policies
	88	.create({ owner: "org", pattern: "approvalcheck.*", action: "block" })
	89	.pipe(Effect.orDie, Effect.as(ElicitationResponse.make({ action: "accept" }))),
	90	},
	91	),
	92	);
	93	expect(error).toMatchObject({ _tag: "ToolBlockedError" });
	94	expect(yield* Ref.get(invocations)).toBe(0);
	95	}),
	96	);
	97	}
	98
	99	it.effect("does not invoke a connection disconnected before acceptance", () =>
	100	Effect.gen(function* () {
	101	const { executor, invocations } = yield* setup;
	102	const error = yield* Effect.flip(
	103	executor.execute(
	104	dynamicAddress,
	105	{},
	106	{
	107	onElicitation: () =>
	108	executor.connections
	109	.remove({ owner: "org", integration, name: connection })
	110	.pipe(Effect.orDie, Effect.as(ElicitationResponse.make({ action: "accept" }))),
	111	},
	112	),
	113	);
	114	expect(error).toMatchObject({ _tag: "ToolNotFoundError" });
	115	expect(yield* Ref.get(invocations)).toBe(0);
	116	}),
	117	);
	118
	119	it.effect("accepts once when access stays valid", () =>
	120	Effect.gen(function* () {
	121	const { executor, invocations } = yield* setup;
	122	const approvals = yield* Ref.make(0);
	123	const result = yield* executor.execute(
	124	dynamicAddress,
	125	{},
	126	{
	127	onElicitation: () =>
	128	Ref.update(approvals, (count) => count + 1).pipe(
	129	Effect.as(ElicitationResponse.make({ action: "accept" })),
	130	),
	131	},
	132	);
	133	expect(result).toBe("executed");
	134	expect(yield* Ref.get(invocations)).toBe(1);
	135	expect(yield* Ref.get(approvals)).toBe(1);
	136	}),
	137	);
	138	});

packages/core/sdk/src/approval-plugin-swap.test.ts+90−0

@@ -0,0 +1,90 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { Effect, Ref } from "effect";
	3
	4	import { ElicitationResponse } from "./elicitation";
	5	import { AuthTemplateSlug, ConnectionName, IntegrationSlug, ToolAddress, ToolName } from "./ids";
	6	import { definePlugin } from "./plugin";
	7	import { makeTestExecutor, memoryCredentialsPlugin } from "./testing";
	8	import { testAccess } from "@executor-js/product-access/testing";
	9
	10	// ---------------------------------------------------------------------------
	11	// Regression: the plugin RUNTIME bound before an approval pause must never
	12	// invoke a REPLACEMENT tool row. If the integration is torn down and
	13	// re-registered under a different plugin while the call waits on a human,
	14	// the tool the user approved no longer exists in that form — the resumed
	15	// call fails as not-found instead of handing the new row (and the new
	16	// connection's credential) to the old plugin's handler.
	17	// ---------------------------------------------------------------------------
	18
	19	const integration = IntegrationSlug.make("swapcheck");
	20	const connection = ConnectionName.make("main");
	21	const address = ToolAddress.make("tools.swapcheck.org.main.run");
	22
	23	describe("integration replaced under a different plugin during approval", () => {
	24	it.effect("fails as not-found; neither plugin's handler runs", () =>
	25	Effect.gen(function* () {
	26	const oldInvocations = yield* Ref.make(0);
	27	const newInvocations = yield* Ref.make(0);
	28
	29	const makeCatalogPlugin = (id: "swap-old" \| "swap-new", invocations: Ref.Ref<number>) =>
	30	definePlugin(() => ({
	31	id,
	32	storage: () => ({}),
	33	resolveTools: () =>
	34	Effect.succeed({
	35	tools: [
	36	{
	37	name: ToolName.make("run"),
	38	description: "Run after approval.",
	39	annotations: { requiresApproval: true },
	40	},
	41	],
	42	}),
	43	invokeTool: () => Ref.update(invocations, (count) => count + 1).pipe(Effect.as("ran")),
	44	extension: (ctx) => ({
	45	register: () =>
	46	ctx.core.integrations.register({
	47	slug: integration,
	48	description: `registered by ${id}`,
	49	config: {},
	50	}),
	51	}),
	52	}))();
	53
	54	const executor = yield* makeTestExecutor({
	55	access: testAccess.member(),
	56	plugins: [
	57	makeCatalogPlugin("swap-old", oldInvocations),
	58	makeCatalogPlugin("swap-new", newInvocations),
	59	memoryCredentialsPlugin(),
	60	] as const,
	61	});
	62	yield* executor["swap-old"].register();
	63	const createConnection = executor.connections.create({
	64	owner: "org",
	65	integration,
	66	name: connection,
	67	template: AuthTemplateSlug.make("none"),
	68	value: "synthetic-swap-test-key",
	69	});
	70	yield* createConnection;
	71
	72	const swapPlugins = Effect.gen(function* () {
	73	// Tear the integration down (cascading its connection and tool rows)
	74	// and re-register the SAME slug under the other plugin, with a fresh
	75	// connection producing a same-named tool row owned by `swap-new`.
	76	yield* executor.integrations.remove(integration);
	77	yield* executor["swap-new"].register();
	78	yield* createConnection;
	79	return ElicitationResponse.make({ action: "accept" });
	80	}).pipe(Effect.orDie);
	81
	82	const error = yield* Effect.flip(
	83	executor.execute(address, {}, { onElicitation: () => swapPlugins }),
	84	);
	85	expect(error).toMatchObject({ _tag: "ToolNotFoundError" });
	86	expect(yield* Ref.get(oldInvocations)).toBe(0);
	87	expect(yield* Ref.get(newInvocations)).toBe(0);
	88	}),
	89	);
	90	});

packages/core/sdk/src/artifact-table.test.ts+10−2

           title: "Theirs",
         });
-        const scoped = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT });
+        const scoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT,
+          owners: ["user", "org"],
+        });
         const visible = await scoped.findMany("artifact", {});
         expect(visible.map((row) => row.id)).toEqual(["art_mine"]);
-        const otherScoped = withQueryContext(db.db, { tenant: TENANT, subject: OTHER_SUBJECT });
+        const otherScoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: OTHER_SUBJECT,
+          owners: ["user", "org"],
+        });
         const otherVisible = await otherScoped.findMany("artifact", {});
         expect(otherVisible.map((row) => row.id)).toEqual(["art_theirs"]);
       }),

packages/core/sdk/src/artifacts.test.ts+24−23

 import { makeTestExecutor } from "./testing";
 import type { ArtifactBinding } from "./artifact";
 import { ConnectionName, IntegrationSlug } from "./ids";
+import { testAccess } from "@executor-js/product-access/testing";
 const binding = (integration: string, owner: "user" | "org", name: string): ArtifactBinding => ({
   integration: IntegrationSlug.make(integration),
 describe("executor.artifacts", () => {
   it.effect("list is empty when nothing is saved", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       expect(yield* executor.artifacts.list()).toEqual([]);
     }),
   );
   it.effect("save mints an id and stores the source", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({
         title: "Active users",
         description: "Daily active users over time",
   it.effect("round-trips connection bindings through the json column", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const bindings = {
         vercel: binding("vercel", "user", "personalVercel"),
         prod: binding("linear", "org", "linearProd"),
   it.effect("saves an artifact that binds nothing as bound-but-empty, not unbound", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({ title: "Static", code: CODE, bindings: {} });
       // `{}` and `null` are different facts: `{}` is an artifact that calls no
       // integration, `null` is one written before bindings existed and whose
   it.effect("leaves bindings null when a save omits them", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({ title: "Legacy", code: CODE });
       expect(saved.bindings).toBe(null);
     }),
   it.effect("overwrites bindings along with the source", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({
         title: "Domains",
         code: CODE,
   it.effect("save defaults a missing description to null", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({ title: "Untitled", code: CODE });
       expect(saved.description).toBe(null);
     }),
   it.effect("list omits the source", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({
         title: "Active users",
         description: "described",
   // storage layer really has.
   it.live("list returns the most recently updated artifact first", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const first = yield* executor.artifacts.save({ title: "First", code: CODE });
       yield* Effect.sleep("1100 millis");
       const second = yield* executor.artifacts.save({ title: "Second", code: CODE });
   it.effect("save with an id overwrites in place", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({ title: "Draft", code: CODE });
       const updated = yield* executor.artifacts.save({
         id: saved.id,
   it.effect("save fails for an id that names no visible artifact", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const result = yield* Effect.result(
         executor.artifacts.save({ id: "art_missing", title: "Ghost", code: CODE }),
       );
   it.effect("get fails for an unknown id", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const result = yield* Effect.result(executor.artifacts.get("art_missing"));
       expect(Result.isFailure(result)).toBe(true);
       if (!Result.isFailure(result)) return;
   it.effect("rename changes only the title", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({
         title: "Old name",
         description: "kept",
   it.effect("rename fails for an unknown id", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const result = yield* Effect.result(
         executor.artifacts.rename({ id: "art_missing", title: "Nope" }),
       );
   it.effect("remove hard-deletes the artifact", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       const saved = yield* executor.artifacts.save({ title: "Temp", code: CODE });
       yield* executor.artifacts.remove({ id: saved.id });
   it.effect("remove is idempotent", () =>
     Effect.gen(function* () {
-      const executor = yield* makeTestExecutor();
+      const executor = yield* makeTestExecutor({ access: testAccess.member() });
       yield* executor.artifacts.remove({ id: "art_missing" });
     }),
   );
     Effect.gen(function* () {
       // Pure-org executors (host request paths with no member bound) have no
       // user partition to file a personal artifact into.
-      const executor = yield* makeTestExecutor({ subject: null });
+      const executor = yield* makeTestExecutor({ access: testAccess.org(), subject: null });
       const result = yield* Effect.result(executor.artifacts.save({ title: "Orphan", code: CODE }));
       expect(Result.isFailure(result)).toBe(true);
     }),
     it.effect("round-trips layout markup, and reads it back as a layout preview", () =>
       Effect.gen(function* () {
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const saved = yield* executor.artifacts.save({
           title: "Revenue",
           code: CODE,
     it.effect("leaves the preview null when a save omits one", () =>
       Effect.gen(function* () {
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const saved = yield* executor.artifacts.save({ title: "Plain", code: CODE });
         expect(saved.preview).toBe(null);
       }),
         // The preview interprets `code`, so a save that replaces the source
         // must replace the picture — including back to null. Carrying it
         // forward would advertise a version of the artifact that is gone.
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const saved = yield* executor.artifacts.save({
           title: "Revenue",
           code: CODE,
     it.effect("setPreview upgrades the preview to the settled render", () =>
       Effect.gen(function* () {
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const saved = yield* executor.artifacts.save({
           title: "Revenue",
           code: CODE,
       Effect.gen(function* () {
         // `updated_at` is the gallery's sort key. Opening an artifact must not
         // move it to the front — being looked at is not an edit.
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const saved = yield* executor.artifacts.save({ title: "Revenue", code: CODE });
         yield* executor.artifacts.setPreview({ id: saved.id, preview: SETTLED });
         expect((yield* executor.artifacts.get(saved.id)).updatedAt).toEqual(saved.updatedAt);
     it.effect("setPreview fails for an artifact that is not visible", () =>
       Effect.gen(function* () {
-        const executor = yield* makeTestExecutor();
+        const executor = yield* makeTestExecutor({ access: testAccess.member() });
         const result = yield* Effect.result(
           executor.artifacts.setPreview({ id: "art_missing", preview: SETTLED }),
         );

packages/core/sdk/src/blob.test.ts+163−14

@@ -3,23 +3,35 @@ import { Effect } from "effect"; · 2 unmodified lines
3		3
4	import { StorageError } from "./fuma-runtime";	4	import { StorageError } from "./fuma-runtime";
5		5
6	import { makeInMemoryBlobStore, pluginBlobStore, type OwnerPartitions } from "./blob";	6	import {
		7	makeInMemoryBlobStore,
		8	pluginBlobStore,
		9	type BlobAccess,
		10	type OwnerPartitions,
		11	} from "./blob";
7		12
8	// v2: owner partitions instead of a scope stack. Reads fall through	13	// v2: owner partitions instead of a scope stack. Reads fall through the
9	// [user, org] (user = innermost); writes/deletes name an explicit owner.	14	// product view's owners in their supplied order (first listed wins); writes
		15	// and deletes name an explicit owner and are refused outside the view.
10	const partitions = (org: string, user: string \| null): OwnerPartitions => ({	16	const partitions = (org: string, user: string \| null): OwnerPartitions => ({
11	org,	17	org,
12	user,	18	user,
13	});	19	});
14		20
		21	// The full member view — the pre-BlobAccess behavior: user shadows org on
		22	// read, both partitions writable.
		23	const fullView: BlobAccess = { owners: ["user", "org"], storageWrites: "allowed" };
		24	const personalOnly: BlobAccess = { owners: ["user"], storageWrites: "allowed" };
		25	const orgOnly: BlobAccess = { owners: ["org"], storageWrites: "allowed" };
		26
15	describe("pluginBlobStore", () => {	27	describe("pluginBlobStore", () => {
16	it.effect("get returns user (innermost) value when both owners have one", () =>	28	it.effect("get returns user (first-ranked) value when both owners have one", () =>
17	Effect.gen(function* () {	29	Effect.gen(function* () {
18	const store = makeInMemoryBlobStore();	30	const store = makeInMemoryBlobStore();
19	yield* store.put("u/my-plugin", "k", "user-value");	31	yield* store.put("u/my-plugin", "k", "user-value");
20	yield* store.put("o/my-plugin", "k", "org-value");	32	yield* store.put("o/my-plugin", "k", "org-value");
21		33
22	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin");	34	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", fullView);
23	const value = yield* plugin.get("k");	35	const value = yield* plugin.get("k");
24	expect(value).toBe("user-value");	36	expect(value).toBe("user-value");
25	}),	37	}),
@@ -30,7 +42,7 @@ describe("pluginBlobStore", () => { · 4 unmodified lines
30	const store = makeInMemoryBlobStore();	42	const store = makeInMemoryBlobStore();
31	yield* store.put("o/my-plugin", "k", "org-value");	43	yield* store.put("o/my-plugin", "k", "org-value");
32		44
33	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin");	45	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", fullView);
34	const value = yield* plugin.get("k");	46	const value = yield* plugin.get("k");
35	expect(value).toBe("org-value");	47	expect(value).toBe("org-value");
36	}),	48	}),
@@ -39,7 +51,7 @@ describe("pluginBlobStore", () => { · 2 unmodified lines
39	it.effect("get returns null when no owner has the key", () =>	51	it.effect("get returns null when no owner has the key", () =>
40	Effect.gen(function* () {	52	Effect.gen(function* () {
41	const store = makeInMemoryBlobStore();	53	const store = makeInMemoryBlobStore();
42	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin");	54	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", fullView);
43	const value = yield* plugin.get("k");	55	const value = yield* plugin.get("k");
44	expect(value).toBeNull();	56	expect(value).toBeNull();
45	}),	57	}),
@@ -50,7 +62,7 @@ describe("pluginBlobStore", () => { · 4 unmodified lines
50	const store = makeInMemoryBlobStore();	62	const store = makeInMemoryBlobStore();
51	yield* store.put("o/my-plugin", "k", "v");	63	yield* store.put("o/my-plugin", "k", "v");
52		64
53	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin");	65	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", fullView);
54	const found = yield* plugin.has("k");	66	const found = yield* plugin.has("k");
55	expect(found).toBe(true);	67	expect(found).toBe(true);
56	}),	68	}),
@@ -59,7 +71,7 @@ describe("pluginBlobStore", () => { · 2 unmodified lines
59	it.effect("has returns false when no owner has the key", () =>	71	it.effect("has returns false when no owner has the key", () =>
60	Effect.gen(function* () {	72	Effect.gen(function* () {
61	const store = makeInMemoryBlobStore();	73	const store = makeInMemoryBlobStore();
62	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin");	74	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", fullView);
63	const found = yield* plugin.has("k");	75	const found = yield* plugin.has("k");
64	expect(found).toBe(false);	76	expect(found).toBe(false);
65	}),	77	}),
@@ -71,8 +83,8 @@ describe("pluginBlobStore", () => { · 5 unmodified lines
71	yield* store.put("u/plugin-a", "k", "a-value");	83	yield* store.put("u/plugin-a", "k", "a-value");
72	yield* store.put("u/plugin-b", "k", "b-value");	84	yield* store.put("u/plugin-b", "k", "b-value");
73		85
74	const pluginA = pluginBlobStore(store, partitions("o", "u"), "plugin-a");	86	const pluginA = pluginBlobStore(store, partitions("o", "u"), "plugin-a", fullView);
75	const pluginB = pluginBlobStore(store, partitions("o", "u"), "plugin-b");	87	const pluginB = pluginBlobStore(store, partitions("o", "u"), "plugin-b", fullView);
76	expect(yield* pluginA.get("k")).toBe("a-value");	88	expect(yield* pluginA.get("k")).toBe("a-value");
77	expect(yield* pluginB.get("k")).toBe("b-value");	89	expect(yield* pluginB.get("k")).toBe("b-value");
78	}),	90	}),
@@ -81,10 +93,14 @@ describe("pluginBlobStore", () => { · 2 unmodified lines
81	it.effect("put rejects owner:user when the executor has no subject", () =>	93	it.effect("put rejects owner:user when the executor has no subject", () =>
82	Effect.gen(function* () {	94	Effect.gen(function* () {
83	const store = makeInMemoryBlobStore();	95	const store = makeInMemoryBlobStore();
84	// No user partition → owner:"user" writes fail.	96	// No user partition → owner:"user" writes fail even when the product
85	const plugin = pluginBlobStore(store, partitions("o", null), "my-plugin");	97	// view lists "user"; the identity clamp is not the product's to relax.
		98	const plugin = pluginBlobStore(store, partitions("o", null), "my-plugin", fullView);
86	const err = yield* plugin.put("k", "v", { owner: "user" }).pipe(Effect.flip);	99	const err = yield* plugin.put("k", "v", { owner: "user" }).pipe(Effect.flip);
87	expect(err).toBeInstanceOf(StorageError);	100	expect(err).toBeInstanceOf(StorageError);
		101	expect(err).toMatchObject({
		102	message: 'Blob write targets owner "user" but the executor has no subject.',
		103	});
88	// Write must not have reached the store.	104	// Write must not have reached the store.
89	expect(yield* store.get("o/my-plugin", "k")).toBeNull();	105	expect(yield* store.get("o/my-plugin", "k")).toBeNull();
90	}),	106	}),
@@ -93,9 +109,142 @@ describe("pluginBlobStore", () => { · 2 unmodified lines
93	it.effect("delete rejects owner:user when the executor has no subject", () =>	109	it.effect("delete rejects owner:user when the executor has no subject", () =>
94	Effect.gen(function* () {	110	Effect.gen(function* () {
95	const store = makeInMemoryBlobStore();	111	const store = makeInMemoryBlobStore();
96	const plugin = pluginBlobStore(store, partitions("o", null), "my-plugin");	112	const plugin = pluginBlobStore(store, partitions("o", null), "my-plugin", fullView);
97	const err = yield* plugin.delete("k", { owner: "user" }).pipe(Effect.flip);	113	const err = yield* plugin.delete("k", { owner: "user" }).pipe(Effect.flip);
98	expect(err).toBeInstanceOf(StorageError);	114	expect(err).toBeInstanceOf(StorageError);
		115	expect(err).toMatchObject({
		116	message: 'Blob write targets owner "user" but the executor has no subject.',
		117	});
		118	}),
		119	);
		120	});
		121
		122	describe("pluginBlobStore access clamp", () => {
		123	it.effect("personal-only view cannot read an org blob", () =>
		124	Effect.gen(function* () {
		125	const store = makeInMemoryBlobStore();
		126	// e.g. an org-shared provider config holding a service-account token.
		127	yield* store.put("o/my-plugin", "k", "org-secret");
		128
		129	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", personalOnly);
		130	expect(yield* plugin.get("k")).toBeNull();
		131	expect(yield* plugin.has("k")).toBe(false);
		132	}),
		133	);
		134
		135	it.effect("personal-only view still reads its own user blob", () =>
		136	Effect.gen(function* () {
		137	const store = makeInMemoryBlobStore();
		138	yield* store.put("u/my-plugin", "k", "user-value");
		139	yield* store.put("o/my-plugin", "k", "org-value");
		140
		141	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", personalOnly);
		142	expect(yield* plugin.get("k")).toBe("user-value");
		143	}),
		144	);
		145
		146	it.effect("org-only view with a bound subject cannot read a user blob", () =>
		147	Effect.gen(function* () {
		148	const store = makeInMemoryBlobStore();
		149	yield* store.put("u/my-plugin", "k", "user-value");
		150
		151	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", orgOnly);
		152	expect(yield* plugin.get("k")).toBeNull();
		153	expect(yield* plugin.has("k")).toBe(false);
		154	}),
		155	);
		156
		157	it.effect("read precedence follows the supplied owner order", () =>
		158	Effect.gen(function* () {
		159	const store = makeInMemoryBlobStore();
		160	yield* store.put("u/my-plugin", "k", "user-value");
		161	yield* store.put("o/my-plugin", "k", "org-value");
		162
		163	const orgFirst = pluginBlobStore(store, partitions("o", "u"), "my-plugin", {
		164	owners: ["org", "user"],
		165	storageWrites: "allowed",
		166	});
		167	expect(yield* orgFirst.get("k")).toBe("org-value");
		168	}),
		169	);
		170
		171	it.effect("put outside the view is rejected and does not reach the store", () =>
		172	Effect.gen(function* () {
		173	const store = makeInMemoryBlobStore();
		174	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", personalOnly);
		175	const err = yield* plugin.put("k", "v", { owner: "org" }).pipe(Effect.flip);
		176	expect(err).toBeInstanceOf(StorageError);
		177	expect(err).toMatchObject({
		178	message:
		179	'Blob write targets the "org" partition, which this product view does not include.',
		180	});
		181	expect(yield* store.get("o/my-plugin", "k")).toBeNull();
		182	}),
		183	);
		184
		185	it.effect("delete outside the view is rejected and leaves the row in place", () =>
		186	Effect.gen(function* () {
		187	const store = makeInMemoryBlobStore();
		188	yield* store.put("o/my-plugin", "k", "org-value");
		189
		190	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", personalOnly);
		191	const err = yield* plugin.delete("k", { owner: "org" }).pipe(Effect.flip);
		192	expect(err).toBeInstanceOf(StorageError);
		193	expect(err).toMatchObject({
		194	message:
		195	'Blob write targets the "org" partition, which this product view does not include.',
		196	});
		197	expect(yield* store.get("o/my-plugin", "k")).toBe("org-value");
		198	}),
		199	);
		200
		201	it.effect("org-only view cannot write the user partition", () =>
		202	Effect.gen(function* () {
		203	const store = makeInMemoryBlobStore();
		204	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", orgOnly);
		205	const err = yield* plugin.put("k", "v", { owner: "user" }).pipe(Effect.flip);
		206	expect(err).toBeInstanceOf(StorageError);
		207	expect(err).toMatchObject({
		208	message:
		209	'Blob write targets the "user" partition, which this product view does not include.',
		210	});
		211	expect(yield* store.get("u/my-plugin", "k")).toBeNull();
		212	}),
		213	);
		214
		215	it.effect("read-only view refuses every mutation but keeps reading", () =>
		216	Effect.gen(function* () {
		217	const store = makeInMemoryBlobStore();
		218	yield* store.put("o/my-plugin", "k", "org-value");
		219
		220	const plugin = pluginBlobStore(store, partitions("o", "u"), "my-plugin", {
		221	owners: ["user", "org"],
		222	storageWrites: "denied",
		223	});
		224	const putErr = yield* plugin.put("k", "v", { owner: "org" }).pipe(Effect.flip);
		225	expect(putErr).toBeInstanceOf(StorageError);
		226	expect(putErr.message).toBe(
		227	'Blob write on plugin "my-plugin" is not allowed: this executor\'s storage is read-only.',
		228	);
		229	const userPutErr = yield* plugin.put("k", "v", { owner: "user" }).pipe(Effect.flip);
		230	expect(userPutErr).toBeInstanceOf(StorageError);
		231	const deleteErr = yield* plugin.delete("k", { owner: "org" }).pipe(Effect.flip);
		232	expect(deleteErr).toBeInstanceOf(StorageError);
		233	// Nothing was mutated; reads keep working.
		234	expect(yield* store.get("o/my-plugin", "k")).toBe("org-value");
		235	expect(yield* plugin.get("k")).toBe("org-value");
		236	}),
		237	);
		238
		239	it.effect('a view listing "user" on a subject-less identity reads org rows only', () =>
		240	Effect.gen(function* () {
		241	const store = makeInMemoryBlobStore();
		242	yield* store.put("o/my-plugin", "k", "org-value");
		243
		244	// `createExecutor` validation rejects this shape, but the seam must not
		245	// assume it: the null partition contributes no namespace, not a failure.
		246	const plugin = pluginBlobStore(store, partitions("o", null), "my-plugin", fullView);
		247	expect(yield* plugin.get("k")).toBe("org-value");
99	}),	248	}),
100	);	249	);
101	});	250	});

packages/core/sdk/src/blob.ts+77−27

@@ -4,18 +4,21 @@ · 3 unmodified lines
4	// metadata and plugin-owned config rows.	4	// metadata and plugin-owned config rows.
5	//	5	//
6	// Plugins see a `PluginBlobStore` that's already namespaced to the	6	// Plugins see a `PluginBlobStore` that's already namespaced to the
7	// plugin id and bound to the executor's scope stack. Reads fall through	7	// plugin id and clamped to the product's `BlobAccess` view. Reads fall
8	// the stack in order (innermost first, first hit wins); writes and	8	// through the view's owners in order (first listed wins); writes and
9	// deletes require an explicit scope id naming where the operation	9	// deletes require an explicit owner naming where the operation should
10	// should land. That mirrors the secrets API — shadowing by key on	10	// land, and are refused outside the view. That mirrors the secrets API —
11	// read, explicit target on write.	11	// shadowing by key on read, explicit target on write — and it is where
		12	// the executor's access decisions apply to blobs at all: the blob table
		13	// sits outside the storage owner policy (isolation is the namespace
		14	// string), so nothing downstream re-checks them.
12	//	15	//
13	// Error channel is `StorageError` — blobs only do read/write/delete, so	16	// Error channel is `StorageError` — blobs only do read/write/delete, so
14	// they never produce `UniqueViolationError`. The HTTP edge translates	17	// they never produce `UniqueViolationError`. The HTTP edge translates
15	// `StorageError` to the opaque public `InternalError({ traceId })`.	18	// `StorageError` to the opaque public `InternalError({ traceId })`.
16	// ---------------------------------------------------------------------------	19	// ---------------------------------------------------------------------------
17		20
18	import { Effect } from "effect";	21	import { Effect, Predicate } from "effect";
19		22
20	import { StorageError, type IFumaClient } from "./fuma-runtime";	23	import { StorageError, type IFumaClient } from "./fuma-runtime";
21	import type { Owner } from "./ids";	24	import type { Owner } from "./ids";
@@ -41,53 +44,101 @@ export interface BlobStore { · 19 unmodified lines
41	}	44	}
42		45
43	export interface PluginBlobStore {	46	export interface PluginBlobStore {
44	/** Read precedence: this subject's own (`user`) value first, then the	47	/** Read precedence: the product view's owner order (`BlobAccess.owners`,
45	* org-shared value. Returns the first non-null. */	48	* first entry wins). Returns the first non-null. */
46	readonly get: (key: string) => Effect.Effect<string \| null, StorageError>;	49	readonly get: (key: string) => Effect.Effect<string \| null, StorageError>;
47	/** Write `value` under `key` for the named owner (`"org"` shared, `"user"`	50	/** Write `value` under `key` for the named owner (`"org"` shared, `"user"`
48	* private). `"user"` requires the executor to be bound to a subject. */	51	* private). The owner must be in the product view, and `"user"` requires
		52	* the executor to be bound to a subject. */
49	readonly put: (	53	readonly put: (
50	key: string,	54	key: string,
51	value: string,	55	value: string,
52	options: { readonly owner: Owner },	56	options: { readonly owner: Owner },
53	) => Effect.Effect<void, StorageError>;	57	) => Effect.Effect<void, StorageError>;
54	/** Delete `key` for the named owner. */	58	/** Delete `key` for the named owner. Bounded like `put`. */
55	readonly delete: (	59	readonly delete: (
56	key: string,	60	key: string,
57	options: { readonly owner: Owner },	61	options: { readonly owner: Owner },
58	) => Effect.Effect<void, StorageError>;	62	) => Effect.Effect<void, StorageError>;
59	/** True if either the user or org partition has a value for `key`. */	63	/** True if any partition in the product view has a value for `key`. */
60	readonly has: (key: string) => Effect.Effect<boolean, StorageError>;	64	readonly has: (key: string) => Effect.Effect<boolean, StorageError>;
61	}	65	}
62		66
63	/** The owner partition strings an executor binding resolves to: the org	67	/** The owner partition strings an executor IDENTITY resolves to: the org
64	* partition (always present) and this subject's user partition (null for a	68	* partition (always present) and this subject's user partition (null for a
65	* pure-org executor). Reads walk `[user, org]`; writes target one. */	69	* pure-org executor). Identity-shaped on purpose — identity-bound consumers
		70	* (the pending-approval store) keep using it directly; which partitions a
		71	* plugin blob store actually reads or writes is the separate, product-owned
		72	* `BlobAccess` decision. */
66	export interface OwnerPartitions {	73	export interface OwnerPartitions {
67	readonly org: string;	74	readonly org: string;
68	readonly user: string \| null;	75	readonly user: string \| null;
69	}	76	}
70		77
		78	/**
		79	* The slice of the product's access decisions the blob seam enforces: the
		80	* blob table is exempt from the storage owner policy (isolation lives in the
		81	* row namespace), so `ExecutorAccess.owners` and the read-only capability
		82	* must be applied HERE, at namespace construction, or not at all.
		83	*
		84	* Structural and required — there is no default view: the caller states the
		85	* product's decision explicitly, and core contributes only the clamps
		86	* (tenant/subject are already baked into `OwnerPartitions`).
		87	*/
		88	export interface BlobAccess {
		89	/** The owner partitions reads see and writes may target, in read-precedence
		90	* order — the first listed owner shadows later ones on `get`. */
		91	readonly owners: readonly Owner[];
		92	/** `"denied"` refuses every `put`/`delete` through this store (the
		93	* read-only posture, `ExecutorAccessCapabilities.storageWrites`). */
		94	readonly storageWrites: "allowed" \| "denied";
		95	}
		96
71	const nsFor = (partition: string, pluginId: string) => `${partition}/${pluginId}`;	97	const nsFor = (partition: string, pluginId: string) => `${partition}/${pluginId}`;
72		98
73	/**	99	/**
74	* Bind a `BlobStore` to an owner partitioning + plugin id. Reads fall through	100	* Bind a `BlobStore` to an owner partitioning + plugin id, clamped to the
75	* `[user, org]` (user first); writes target an explicit owner. Used by the	101	* product's `BlobAccess`. Reads fall through the access owners in their
76	* executor to build the `blobs` field handed to each plugin's `storage` factory.	102	* supplied order (first hit wins); writes target an explicit owner and are
		103	* refused outside the access view. Used by the executor to build the `blobs`
		104	* field handed to each plugin's `storage` factory.
77	*/	105	*/
78	export const pluginBlobStore = (	106	export const pluginBlobStore = (
79	store: BlobStore,	107	store: BlobStore,
80	partitions: OwnerPartitions,	108	partitions: OwnerPartitions,
81	pluginId: string,	109	pluginId: string,
		110	access: BlobAccess,
82	): PluginBlobStore => {	111	): PluginBlobStore => {
83	const readNamespaces = (): readonly string[] =>	112	const partitionOf = (owner: Owner): string \| null =>
84	(partitions.user == null ? [partitions.org] : [partitions.user, partitions.org]).map((p) =>	113	owner === "org" ? partitions.org : partitions.user;
85	nsFor(p, pluginId),	114
86	);	115	// The product view's partitions, in ITS precedence order. An owner the
		116	// identity cannot carry (`"user"` with no subject) maps to no namespace
		117	// rather than failing a read — the partition simply has no rows to see.
		118	const readNamespaces: readonly string[] = access.owners
		119	.map(partitionOf)
		120	.filter(Predicate.isNotNull)
		121	.map((partition) => nsFor(partition, pluginId));
87		122
88	const partitionFor = (owner: Owner): Effect.Effect<string, StorageError> => {	123	const partitionFor = (owner: Owner): Effect.Effect<string, StorageError> => {
89	if (owner === "org") return Effect.succeed(partitions.org);	124	if (access.storageWrites === "denied") {
90	if (partitions.user == null) {	125	return Effect.fail(
		126	new StorageError({
		127	message: `Blob write on plugin "${pluginId}" is not allowed: this executor's storage is read-only.`,
		128	cause: undefined,
		129	}),
		130	);
		131	}
		132	if (!access.owners.includes(owner)) {
		133	return Effect.fail(
		134	new StorageError({
		135	message: `Blob write targets the "${owner}" partition, which this product view does not include.`,
		136	cause: undefined,
		137	}),
		138	);
		139	}
		140	const partition = partitionOf(owner);
		141	if (partition == null) {
91	return Effect.fail(	142	return Effect.fail(
92	new StorageError({	143	new StorageError({
93	message: 'Blob write targets owner "user" but the executor has no subject.',	144	message: 'Blob write targets owner "user" but the executor has no subject.',
@@ -95,16 +146,15 @@ export const pluginBlobStore = ( · 1 unmodified line
95	}),	146	}),
96	);	147	);
97	}	148	}
98	return Effect.succeed(partitions.user);	149	return Effect.succeed(partition);
99	};	150	};
100		151
101	return {	152	return {
102	get: (key) =>	153	get: (key) =>
103	Effect.gen(function* () {	154	Effect.gen(function* () {
104	const namespaces = readNamespaces();	155	const hits = yield* store.getMany(readNamespaces, key);
105	const hits = yield* store.getMany(namespaces, key);
106	if (hits.size === 0) return null;	156	if (hits.size === 0) return null;
107	for (const ns of namespaces) {	157	for (const ns of readNamespaces) {
108	const v = hits.get(ns);	158	const v = hits.get(ns);
109	if (v !== undefined) return v;	159	if (v !== undefined) return v;
110	}	160	}
@@ -118,7 +168,7 @@ export const pluginBlobStore = ( · 7 unmodified lines
118	Effect.flatMap(partitionFor(options.owner), (partition) =>	168	Effect.flatMap(partitionFor(options.owner), (partition) =>
119	store.delete(nsFor(partition, pluginId), key),	169	store.delete(nsFor(partition, pluginId), key),
120	),	170	),
121	has: (key) => store.getMany(readNamespaces(), key).pipe(Effect.map((hits) => hits.size > 0)),	171	has: (key) => store.getMany(readNamespaces, key).pipe(Effect.map((hits) => hits.size > 0)),
122	};	172	};
123	};	173	};
124		174

packages/core/sdk/src/connections.test.ts+85−22

 import type { CredentialProvider } from "./provider";
 import { makeTestConfig, makeTestExecutor } from "./testing";
 import { ToolResult } from "./tool-result";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: v1 connection-refresh lifecycle, ConnectionProvider.refresh,
 // SecretProvider, accessToken token-refresh + in-flight dedup tests — the v2
 }))();
 const setup = () =>
-  makeTestExecutor({ plugins: [demoPlugin] as const }).pipe(
+  makeTestExecutor({ access: testAccess.member(), plugins: [demoPlugin] as const }).pipe(
     Effect.tap((executor) => executor.demo.seed()),
   );
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [gatedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [gatedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.gated.seed();
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [plugin] as const });
+        const config = makeTestConfig({ access: testAccess.member(), plugins: [plugin] as const });
         const first = yield* createExecutor(config);
         yield* first.recoverable.seed();
         return wrap(db);
       };
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: blindfoldConnectionReads(config.db),
               : Effect.sync(() => void store.set(String(id), value)),
         });
         const executor = yield* makeTestExecutor({
+          access: testAccess.member(),
           plugins: [durabilityPlugin(provider)] as const,
         });
         yield* executor.durable.seed();
             ? Effect.fail(new StorageError({ message: "provider write refused", cause: undefined }))
             : Effect.sync(() => void store.set(String(id), value)),
       });
-      const executor = yield* makeTestExecutor({ plugins: [durabilityPlugin(provider)] as const });
+      const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       yield* executor.durable.seed();
       const result = yield* Effect.result(
             : Effect.sync(() => void store.set(String(id), value)),
         delete: undefined,
       });
-      const executor = yield* makeTestExecutor({ plugins: [durabilityPlugin(provider)] as const });
+      const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       yield* executor.durable.seed();
       const warnings: string[] = [];
             ? Effect.fail(new StorageError({ message: "provider write refused", cause: undefined }))
             : Effect.sync(() => void store.set(String(id), value)),
       });
-      const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: failableCompensationRowDelete(config.db, () => failRowDelete),
           },
         });
         const executor = yield* makeTestExecutor({
+          access: testAccess.member(),
           plugins: [durabilityPlugin(provider)] as const,
         });
         yield* executor.durable.seed();
           },
         });
         const raceState = { armed: false };
-        const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [durabilityPlugin(provider)] as const,
+        });
         const executor = yield* createExecutor({
           ...config,
           db: staleCompensationRead(config.db, raceState),
             : Effect.sync(() => void store.set(String(id), value)),
       });
       const readState = { armed: false };
-      const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: failableConfirmationRead(config.db, readState),
             ? Effect.fail(new StorageError({ message: "provider write refused", cause: undefined }))
             : Effect.sync(() => void store.set(String(id), value)),
       });
-      const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: failableConnectionDeletes(config.db, () => failRowDelete),
             ? Effect.die("provider crashed")
             : Effect.sync(() => void store.set(String(id), value)),
       });
-      const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [durabilityPlugin(provider)] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: failableCompensationRowDelete(config.db, () => failRowDelete),
               ? Deferred.succeed(secondWriteEntered, undefined).pipe(Effect.andThen(Effect.never))
               : Effect.sync(() => void store.set(String(id), value)),
         });
-        const config = makeTestConfig({ plugins: [durabilityPlugin(provider)] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [durabilityPlugin(provider)] as const,
+        });
         const executor = yield* createExecutor({
           ...config,
           db: failableCompensationRowDelete(config.db, () => failRowDelete),
 describe("connections.list / get", () => {
   it.effect("only includes full health diagnostics in verbose core tool output", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [demoPlugin] as const, coreTools: {} });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+        coreTools: {},
+      });
       const executor = yield* createExecutor(config);
       yield* executor.demo.seed();
       yield* executor.connections.create({
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.guarded.seed();
         yield* executor.connections.create({
                 }),
             }),
           }))();
-          const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+          const config = makeTestConfig({
+            access: testAccess.member(),
+            plugins: [guardedPlugin] as const,
+          });
           const executor = yield* createExecutor(config);
           yield* executor.guarded.seed();
           yield* executor.connections.create({
                 }),
             }),
           }))();
-          const config = makeTestConfig({ plugins: [storedStatePlugin] as const });
+          const config = makeTestConfig({
+            access: testAccess.member(),
+            plugins: [storedStatePlugin] as const,
+          });
           const executor = yield* createExecutor(config);
           yield* executor["stored-state"].seed();
           yield* executor.connections.create({
           }),
         }))();
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: [guardedPlugin] as const }),
+          makeTestConfig({ access: testAccess.member(), plugins: [guardedPlugin] as const }),
         );
         yield* executor.guarded.seed();
         yield* executor.connections.create({
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.guarded.seed();
         yield* executor.connections.create({
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.guarded.seed();
         yield* executor.connections.create({
               }),
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.guarded.seed();
         yield* executor.connections.create({
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor({
           ...config,
           db: instrumentTransactions(config.db, {
           }),
         }))();
-        const config = makeTestConfig({ plugins: [guardedPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [guardedPlugin] as const,
+        });
         const executor = yield* createExecutor(config);
         yield* executor.guarded.seed();
         for (const name of ["broken", "healthy"]) {
   return Effect.gen(function* () {
     const config = makeTestConfig({
+      access: testAccess.member(),
       plugins: [plugin] as const,
       coreTools: { webBaseUrl: "http://localhost:3000" },
     });
       // Both executors share ONE root db handle — and therefore one gate map;
       // only the key separates their probes.
       const configA = makeTestConfig({
+        access: testAccess.member(),
         plugins: [probingPlugin()] as const,
         tenant: "a",
         subject: "user:b",

packages/core/sdk/src/core-schema.ts+17−1

@@ -49,7 +49,23 @@ const unscopedExecutorTable = <const TColumns extends UserColumns>( · 48 unmodified lines
49	id: keyColumn("id"),	49	id: keyColumn("id"),
50	});	50	});
51	out.unique(`${name}_id_uidx`, ["id"]);	51	out.unique(`${name}_id_uidx`, ["id"]);
52	return out.policy({ name: executorUnscopedPolicyName });	52	// No visibility condition (isolation lives in the namespace string), but
		53	// the read-only / delete-only postures still hold for the FumaDB-backed
		54	// blob store. External blob backends never see table policies, so the
		55	// executor ALSO wraps its base BlobStore when storage writes are denied —
		56	// this is defense in depth for the table-backed path, not the sole guard.
		57	return out.policy<ExecutorOwnerPolicyContext>({
		58	name: executorUnscopedPolicyName,
		59	onCreate: ({ context }) => assertReachReadOnly(name, "write", context),
		60	onUpdate: ({ context }) => {
		61	assertReachReadOnly(name, "write", context);
		62	return true;
		63	},
		64	onDelete: ({ context }) => {
		65	assertReachReadOnly(name, "delete", context);
		66	return true;
		67	},
		68	});
53	};	69	};
54		70
55	/** A tenant-shared table (catalog / blobs) — partitioned only by `tenant`. */	71	/** A tenant-shared table (catalog / blobs) — partitioned only by `tenant`. */

packages/core/sdk/src/errors.ts+3−4

   }
 }
-/** A connection create or workspace-level mutation (an `owner: "org"` row, or
+/** A user-intent settings mutation was denied by the product's
- *  the tenant-shared integration catalog) was attempted on an executor bound
+ *  `ExecutorAccess.settingsWrite` decision for its target.
- *  with `orgWrites: "denied"` — a member who may USE workspace resources but
+ *  Reads, tool execution, and operational writes (token
- *  not configure them. Reads, tool execution, and operational writes (token
  *  refresh, catalog re-sync) are unaffected; only the user-intent settings
  *  surfaces raise this. */
 export class OrgWriteDeniedError

packages/core/sdk/src/executor.test.ts+44−7

 import { IntegrationDetectionResult } from "./types";
 import { makeTestConfig, makeTestExecutor, memoryCredentialsPlugin } from "./testing";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: v1 secret browser-handoff, source.configure, case-insensitive tool-id
 // resolution, secrets/sources/scope-stack. The integration coverage below is
   it.effect("rolls back plugin and core writes from ctx.transaction failures", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
       });
       const result = yield* Effect.result(executor.demo.failAfterPluginAndCoreWrites());
         close: () => Effect.sync(() => void (closed = true)),
       }))();
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [closingPlugin] as const,
       });
       yield* executor.close();
     Effect.gen(function* () {
       const events: Array<{ kind: string; pluginKey: string; slug: string }> = [];
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         onIntegrationChange: (event) =>
           Effect.sync(() => {
   it.effect("a failing onIntegrationChange observer never fails the operation", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         onIntegrationChange: () => Effect.die("observer exploded"),
       });
     Effect.gen(function* () {
       const events: string[] = [];
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         onIntegrationChange: (event) => Effect.sync(() => void events.push(String(event.slug))),
       });
   it.effect("projects core tools as the built-in Executor integration", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         coreTools: { webBaseUrl: "http://localhost:3000" },
       });
       const integrations = yield* executor.integrations.list();
   it.effect("can omit provider tools from the built-in Executor integration", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         coreTools: {
           webBaseUrl: "http://localhost:3000",
           includeProviders: false,
   it.effect("creates provider-backed connections through the built-in Executor tools", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         coreTools: { webBaseUrl: "http://localhost:3000" },
       });
   it.effect("creates a provider-backed legacy slug-none connection through the core tool", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         coreTools: { webBaseUrl: "http://localhost:3000" },
       });
   it.effect("removes catalog integrations through the built-in Executor tools", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
         coreTools: {},
       });
   it.effect("omits invalid auth methods and surfaces plugin and tool sync diagnostics", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), diagnosticsPlugin] as const,
         coreTools: {},
       });
   it.effect("preserves actionable health from an incomplete tool catalog", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), diagnosticsPlugin] as const,
         coreTools: {},
       });
   it.effect("hands pasted credential entry to the web UI", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         coreTools: { webBaseUrl: "http://localhost:3000" },
       });
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const executor = yield* makeTestExecutor({
+          access: testAccess.member(),
           plugins: [demoPlugin] as const,
           coreTools: { webBaseUrl: "http://localhost:3000" },
           redirectUri: null,
         detector("high-detector", "high"),
         detector("medium-detector", "medium"),
       ] as const;
-      const executor = yield* makeTestExecutor({ plugins });
+      const executor = yield* makeTestExecutor({ access: testAccess.member(), plugins });
       const results = yield* executor.integrations.detect("https://example.com/thing");
       // Every detector recognizes the URL; the list contains all three.
       expect(results.map((r) => r.kind).sort()).toEqual([
   it.effect("tools.schema returns roots with shared reachable definitions", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
       });
       yield* executor.demo.seed();
   it.effect("execute dispatches a connection-produced tool to the owning plugin", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
       });
       yield* executor.demo.seed();
   it.effect("execute on a missing address fails with ToolNotFoundError", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [demoPlugin] as const,
       });
       yield* executor.demo.seed();
 describe("muscle memory (observed output shapes)", () => {
   const provisioned = Effect.fn(function* () {
     const executor = yield* makeTestExecutor({
+      access: testAccess.member(),
       plugins: [demoPlugin] as const,
       coreTools: { webBaseUrl: "http://localhost:3000" },
     });
 const recordToolRowLaunch = (maxOps?: number) =>
   Effect.gen(function* () {
     const recorder = makeReadOrderRecorder();
-    const config = makeTestConfig({ plugins: [demoPlugin] as const });
+    const config = makeTestConfig({ access: testAccess.member(), plugins: [demoPlugin] as const });
     const executor = yield* createExecutor({
       ...config,
       db: withRecordedReads(config.db, recorder.record),
     const calls = { count: 0 };
     const provider = countingProvider(calls, (run) => recorder.record("credential.get", run));
     const config = makeTestConfig({
+      access: testAccess.member(),
       plugins: [invokeConcurrencyPlugin(provider)] as const,
     });
     const executor = yield* createExecutor({
     Effect.gen(function* () {
       const calls = { count: 0 };
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [invokeConcurrencyPlugin(countingProvider(calls))] as const,
       });
       yield* seedRunConnection(executor);
   it.effect("fails with ConnectionNotFoundError when the tool row outlives its connection", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor(config);
       yield* seedRunConnection(executor);
   it.effect("unknown-tool error surfaces while the speculative reads hang forever", () =>
     Effect.gen(function* () {
       const faults = makeReadFaults();
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: withFaultedReads(config.db, faults.fault),
   it.effect("a blocked tool reports ToolBlockedError while the connection read hangs", () =>
     Effect.gen(function* () {
       const faults = makeReadFaults();
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: withFaultedReads(config.db, faults.fault),
   it.effect("failing speculative reads neither mask the branch error nor unhandled-reject", () =>
     Effect.gen(function* () {
       const faults = makeReadFaults();
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: withFaultedReads(config.db, faults.fault),
     () =>
       Effect.gen(function* () {
         const faults = makeReadFaults();
-        const config = makeTestConfig({ plugins: [demoPlugin] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [demoPlugin] as const,
+        });
         const executor = yield* createExecutor({
           ...config,
           db: withFaultedReads(config.db, faults.fault),
       const faults = makeReadFaults();
       const armable = armableFailingProvider();
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [invokeConcurrencyPlugin(armable.provider)] as const,
       });
       const executor = yield* createExecutor({

packages/core/sdk/src/executor.ts+276−220

   type OAuthClientRow,
   type ToolInvocationRow,
   type ToolRow,
-  type ToolPolicyRow,
 } from "./core-schema";
 import {
   ElicitationDeclinedError,
   type OnElicitation,
   type InvokeOptions,
 } from "./elicitation";
-import { currentOrgWriteAccess, type OrgWriteAccess } from "./org-write-access";
+import { executorAccessViolation, type ExecutorAccess, type ToolPolicyEvaluator } from "./access";
 import {
   restoreCredentialSnapshotsWithRecheck,
   snapshotCredentialWrites,
 import {
   comparePolicyRow,
   isValidPattern,
-  matchPattern,
   positionForNewPattern,
-  resolveEffectivePolicy,
   rowToToolPolicy,
   type CreateToolPolicyInput,
   type EffectivePolicy,
   StaticToolDecl,
   StorageDeps,
   ToolPolicyProvider,
-  ToolPolicyProviderRule,
   ToolInvocationCredential,
 } from "./plugin";
 import {
   /**
    * The PLATFORM VIEW: read-only, tenant-wide reads across every subject.
-   * Present only when the executor was built with `platformView: true`
+   * Present only when the executor was built with a product access granting
-   * (default off) — every other surface on this executor stays bound to the
+   * `capabilities.adminReads` — every other surface on this executor stays
-   * single `{ tenant, subject }` product view and is unaffected by this one.
+   * bound to the single `{ tenant, subject }` product view and is unaffected
-   * Internal admin surface; the public HTTP shape is a separate concern.
+   * by this one. Internal admin surface; the public HTTP shape is a separate
+   * concern.
    */
   readonly admin?: ExecutorAdmin;
   /** Saved generative-UI artifacts, visible to the bound owner scope. */
    */
   readonly onIntegrationChange?: (event: IntegrationChangeEvent) => Effect.Effect<void>;
   /**
-   * Opt into the PLATFORM VIEW: a read-only, tenant-wide `executor.admin`
+   * The product's access decisions for this binding — REQUIRED, with no core
-   * surface that reads across every subject in the tenant (see
+   * default. The product (host composition root) states which owner
-   * {@link ExecutorAdmin}). Default OFF — `admin` is simply absent, so the
+   * partitions this binding reads and in what precedence, whether it may
-   * escape hatch has to be asked for by a host that has authorized an
+   * configure workspace-level state (consulted live at every guarded sink),
-   * org-level caller.
+   * and its view capabilities (`capabilities.adminReads` exposes the
+   * tenant-observing `admin` surface, whose reads span every subject;
+   * `capabilities.storageWrites` sets the storage posture).
+   * Core validates the shape against the binding, enforces the decisions at
+   * its sinks, and clamps everything with the storage owner policy — tenant
+   * isolation is never product-configurable. See {@link ExecutorAccess} and
+   * `@executor-js/product-access` for the product rule implementations.
    *
-   * Enabling it makes the WHOLE executor read-only, not just `admin`: the base
+   * `capabilities.storageWrites: "denied"` makes the WHOLE executor
-   * owner context carries `writes: "denied"`, so `connections`, `policies`,
+   * read-only, not just `admin`: the base owner context carries
-   * `integrations` and `oauth` refuse every create/update/delete at the storage
+   * `writes: "denied"`, so `connections`, `policies`, `integrations` and
-   * boundary. An executor built for an org-level caller is an observer, and
+   * `oauth` refuse every create/update/delete at the storage boundary. READS
-   * `admin` being its only tenant-wide surface is not the same as it being its
+   * still differ by surface: only `admin` is tenant-wide; every other
-   * only guarded one.
+   * surface stays bound to `{ tenant, subject }` — widening them would
-   *
+   * expose every subject's connection rows, credential item ids included.
-   * READS still differ by surface: only `admin` is tenant-wide. Every other
-   * surface stays bound to `{ tenant, subject }` — widening them would expose
-   * every subject's connection rows, credential item ids included.
-   */
-  readonly platformView?: boolean;
-  /**
-   * Whether this binding may CONFIGURE workspace-level state: `owner: "org"`
-   * rows (shared connections, org tool policies, org OAuth clients) and the
-   * tenant-shared integration catalog. Hosts derive it from the acting
-   * member's role — admins bind `"allowed"`, plain members `"denied"`.
-   * `"request"` reads the fiber-local {@link CurrentOrgWriteAccess} at every
-   * guarded sink. Session hosts bind that reference from the freshly
-   * authenticated request without caching a positive authorization decision
-   * for the session lifetime.
-   * Defaults to `"allowed"` for non-session callers with no role model
-   * (local's single user, the CLI, tests).
-   *
-   * `"denied"` gates only the USER-INTENT settings surfaces (`policies`,
-   * `connections` create/update/remove in Workspace scope, `integrations`
-   * update/remove/healthCheck, OAuth client CRUD and connect flows in Workspace
-   * scope, new-integration registration). Members may still create and manage
-   * Personal connections and OAuth apps. They also USE workspace resources:
-   * reads, tool execution over org connections, and the operational writes
-   * those imply (token refresh, tool-catalog re-sync) are deliberately
-   * untouched — which is why this is a surface gate, not a storage-policy axis
-   * like `platformView`'s blanket `writes: "denied"`.
    */
-  readonly orgWrites?: OrgWriteAccess | "request";
+  readonly access: ExecutorAccess;
 }
 /** Default freshness window for remote-catalog connections (see
   readonly core: CoreDb;
   readonly pluginId: string;
   readonly owner: OwnerBinding;
+  /** Product-supplied owner precedence (`ExecutorAccess.owners`):
+   *  which partitions reads see, first entry shadowing later ones. */
+  readonly readOwners: readonly Owner[];
 }): PluginStorageFacade => {
-  // Owner partitions: org always, plus this subject's user partition.
+  const readOwners = input.readOwners;
-  const readOwners: readonly Owner[] = input.owner.subject == null ? ["org"] : ["user", "org"];
   const ownerSubject = (owner: Owner): { owner: Owner; subject: string } | null => {
     if (owner === "org") return { owner: "org", subject: ORG_SUBJECT };
       );
   };
-  const ownerRank = (owner: Owner): number => readOwners.indexOf(owner);
+  // A row whose owner is outside the view (only reachable if this facade is
+  // ever handed a wider db handle) sorts LAST, never shadowing view rows.
+  const ownerRank = (owner: Owner): number => {
+    const rank = readOwners.indexOf(owner);
+    return rank === -1 ? readOwners.length : rank;
+  };
   const sortByOwnerPrecedence = (rows: readonly CoreRow<"plugin_storage">[]) =>
     [...rows].sort((left, right) => {
     const tenant = String(config.tenant);
     const subject = config.subject != null ? String(config.subject) : null;
+    // The product's access decisions, validated against the binding before
+    // anything else is built: a composition root that hands a member-shaped
+    // access to a subject-less binding (or vice versa) is a programmer error
+    // that must fail the boot, not silently narrow.
+    const access = config.access;
+    const accessViolation = executorAccessViolation(access, subject);
+    if (accessViolation != null) {
+      return yield* new StorageError({ message: accessViolation, cause: undefined });
+    }
+    // The product's visible/writable partitions in precedence order — stamped
+    // onto every storage context and threaded to every owner-ordered read.
+    const accessOwners = access.owners;
     const ownerBinding: OwnerBinding = {
       tenant: config.tenant,
       subject: config.subject ?? null,
           )
         : Effect.void;
-    // Workspace-settings gate (`ExecutorConfig.orgWrites`). Called at the top
+    // Settings gate (`ExecutorAccess.settingsWrite`). Called at the top of
-    // of every user-intent workspace-level mutation: with an explicit owner it
+    // every user-intent settings mutation with the TARGET core is about to
-    // refuses only `"org"` targets; with no owner it guards a tenant-shared
+    // touch — an owner-scoped row, or (with no owner) a tenant-shared
-    // surface outright. Deliberately NOT wired into the storage owner policy —
+    // workspace surface. WHICH targets a given principal may configure is
-    // operational org-row writes (token refresh, tool-catalog re-sync) must
+    // entirely the product's rule; core only describes the target, asks
-    // keep working for a denied member.
+    // live on every call (a request-bound implementation is re-read after
+    // pauses and on resume; nothing is cached), and enforces a denial as
+    // `OrgWriteDeniedError`. Deliberately NOT wired into the storage owner
+    // policy — operational org-row writes (token refresh, tool-catalog
+    // re-sync) must keep working for a settings-denied member.
     const guardOrgWrite = (owner?: Owner): Effect.Effect<void, OrgWriteDeniedError> =>
       Effect.gen(function* () {
-        const access =
+        const decision = yield* access.settingsWrite(
-          config.orgWrites === "request" ? yield* currentOrgWriteAccess : config.orgWrites;
+          owner === undefined ? { kind: "workspace" } : { kind: "owner", owner },
-        if (access === "denied" && (owner === undefined || owner === "org")) {
+        );
+        if (decision === "denied") {
           return yield* new OrgWriteDeniedError();
         }
       });
     const ownerContext: ExecutorOwnerPolicyContext = {
       tenant,
       subject,
-      ...(config.platformView === true ? { writes: "denied" as const } : {}),
+      // The product's row visibility/write partitions — enforced (never
+      // chosen) by the storage owner policy, which clamps them to the
+      // binding's tenant and subject.
+      owners: accessOwners,
+      ...(access.capabilities.storageWrites === "denied" ? { writes: "denied" as const } : {}),
     };
     const rootDb = withQueryContext(rootDbUntyped, ownerContext);
     // Shared across executors over one database, so the gate key must carry the
         } satisfies ExecutorOwnerPolicyContext,
       }),
     );
-    const blobs = config.blobs ?? makeFumaBlobStore(fuma);
+    // The blob table sits OUTSIDE the storage owner policy (isolation is the
+    // namespace string), and a host-supplied backend (`config.blobs`: R2, …)
+    // never sees the FumaDB table policies at all. So the read-only posture
+    // is applied HERE, once, on the base store — pending approvals and every
+    // plugin namespace inherit it. Per-partition visibility is the plugin
+    // blob store's own `BlobAccess` clamp below.
+    const rawBlobs = config.blobs ?? makeFumaBlobStore(fuma);
+    const readOnlyBlobStore = (store: BlobStore): BlobStore => {
+      const refuse = (operation: string) =>
+        Effect.fail(
+          new StorageError({
+            message: `Blob ${operation} is not allowed: this executor's storage is read-only.`,
+            cause: undefined,
+          }),
+        );
+      return {
+        get: (namespace, key) => store.get(namespace, key),
+        getMany: (namespaces, key) => store.getMany(namespaces, key),
+        has: (namespace, key) => store.has(namespace, key),
+        put: () => refuse("write"),
+        delete: () => refuse("delete"),
+      };
+    };
+    const blobs =
+      access.capabilities.storageWrites === "denied" ? readOnlyBlobStore(rawBlobs) : rawBlobs;
     const transaction = <A, E>(effect: Effect.Effect<A, E>) => fuma.transaction(effect);
     // Runtime-observed output shapes ("muscle memory"): learned on the
         core,
         pluginId: SHAPE_MEMORY_PLUGIN_ID,
         owner: ownerBinding,
+        readOwners: accessOwners,
       }),
     );
     // runtime can recognize and retry a row stranded before its write ran.
     const credentialWriteRuntimeId = crypto.randomUUID();
-    const staticToolOwner = (): Owner => (subject == null ? "org" : "user");
+    // The partition static tools present under: the product's first-ranked
+    // owner (a bound member's "user", a subject-less binding's "org").
+    const staticToolOwner = (): Owner => accessOwners[0]!;
     const staticToolConnection = (integration: StaticIntegrationDecl): ConnectionName =>
       ConnectionName.make(integration.id === EXECUTOR_INTEGRATION_ID ? "coreTools" : "static");
           const existing = yield* findIntegrationRow(input.slug);
           const config = input.config === undefined ? null : input.config;
           if (existing) {
-            // Extension methods also run for subjectless boot/system executors,
+            // Replacement of an existing catalog row is the same workspace
-            // which must be able to converge existing catalog rows. A bound
+            // mutation as creation. WHO may perform it — an end-user admin, or
-            // subject is an end-user principal, so its replacement is the same
+            // a subject-less boot-convergence service — is entirely the
-            // workspace mutation as creation and requires the live role guard.
+            // product's `settingsWrite` rule (workspaceServiceAccess allows
-            if (subject !== null) yield* guardOrgWrite();
+            // it); core keeps no subject-less exemption of its own.
+            yield* guardOrgWrite();
             yield* core.updateMany("integration", {
               where: (b: AnyCb) => b("slug", "=", String(input.slug)),
               set: {
       });
     // ------------------------------------------------------------------
-    // Active policy source.
+    // Effective tool policy — the PRODUCT's evaluation, core's enforcement.
+    //
+    // Core assembles the rule material (the stored rows as a lazy read, and
+    // the plugin-registered provider when a toolkit session bound one) and
+    // hands it to `ExecutorAccess.toolPolicy`, once per surface operation.
+    // Owner ranking, cross-owner merging, the plugin-default fallback and
+    // the capability-allowlist default all live in that product hook; core
+    // only enforces the returned `EffectivePolicy` (block refuses, approval
+    // gates).
     // ------------------------------------------------------------------
-    type ActivePolicyRuleSet =
+    const makeToolPolicyEvaluator = (): Effect.Effect<ToolPolicyEvaluator, StorageFailure> =>
-      | { readonly kind: "global"; readonly rows: readonly ToolPolicyRow[] }
+      access.toolPolicy({
-      | {
+        policyRows: core.findMany("tool_policy", {}),
-          readonly kind: "provider";
+        provider: activeToolPolicyProvider,
-          readonly provider: ToolPolicyProvider;
+      });
-          readonly rules: readonly ToolPolicyProviderRule[] | null;
-        }
-      | {
-          readonly kind: "prepared";
-          readonly resolve: (input: {
-            readonly toolId: string;
-            readonly defaultRequiresApproval?: boolean;
-          }) => EffectivePolicy;
-        };
-    const compareProviderPolicyRule = (
-      a: ToolPolicyProviderRule,
-      b: ToolPolicyProviderRule,
-    ): number => {
-      if (a.position < b.position) return -1;
-      if (a.position > b.position) return 1;
-      return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
-    };
-    const resolveProviderPolicyFromRules = (
-      toolId: string,
-      rules: readonly ToolPolicyProviderRule[],
-    ): EffectivePolicy => {
-      for (const rule of [...rules].sort(compareProviderPolicyRule)) {
-        if (!matchPattern(rule.pattern, toolId)) continue;
-        return {
-          action: rule.action,
-          source: "user",
-          pattern: rule.pattern,
-          policyId: rule.id,
-        };
-      }
-      // Toolkit-style providers are capability allowlists. No matching rule
-      // means the tool is outside the capability boundary.
-      return {
-        action: "block",
-        source: "user",
-        pattern: "*",
-      };
-    };
-    const listActivePolicyRuleSet = (): Effect.Effect<ActivePolicyRuleSet, StorageFailure> =>
-      activeToolPolicyProvider
-        ? // Batched per-operation resolver: fetch all policy + connection state
-          // once, then resolve every tool in this operation against that
-          // snapshot. Avoids the per-tool resolve N+1 on the list surface.
-          activeToolPolicyProvider.prepare
-          ? activeToolPolicyProvider.prepare().pipe(
-              Effect.map((resolve) => ({
-                kind: "prepared" as const,
-                resolve,
-              })),
-            )
-          : activeToolPolicyProvider.resolve
-            ? Effect.succeed({
-                kind: "provider" as const,
-                provider: activeToolPolicyProvider,
-                rules: null,
-              })
-            : activeToolPolicyProvider.list().pipe(
-                Effect.map((rules) => ({
-                  kind: "provider" as const,
-                  provider: activeToolPolicyProvider!,
-                  rules,
-                })),
-              )
-        : core
-            .findMany("tool_policy", {})
-            .pipe(Effect.map((rows) => ({ kind: "global" as const, rows })));
-    const resolvePolicyFromRuleSet = (
-      toolId: string,
-      ruleSet: ActivePolicyRuleSet,
-      defaultRequiresApproval?: boolean,
-    ): Effect.Effect<EffectivePolicy, StorageFailure> =>
-      ruleSet.kind === "prepared"
-        ? Effect.succeed(ruleSet.resolve({ toolId, defaultRequiresApproval }))
-        : ruleSet.kind === "provider"
-          ? ruleSet.provider.resolve
-            ? ruleSet.provider.resolve({ toolId, defaultRequiresApproval })
-            : Effect.succeed(resolveProviderPolicyFromRules(toolId, ruleSet.rules ?? []))
-          : Effect.succeed(
-              resolveEffectivePolicy(
-                toolId,
-                ruleSet.rows,
-                ownerRankForRow,
-                defaultRequiresApproval,
-              ),
-            );
     // ------------------------------------------------------------------
     // Tools (read surface)
       // network side effects on a read-only credential. Skip it entirely:
       // read-only-ness of the platform read path is a stated invariant here,
       // not an accident of the best-effort catch below.
-      if (config.platformView === true) return;
+      if (access.capabilities.storageWrites === "denied") return;
       const integrations = yield* core.findMany("integration", {});
       if (integrations.length === 0) return;
       const integrationBySlug = new Map(integrations.map((row) => [row.slug, row] as const));
           select: TOOL_INVOCATION_COLUMNS,
         });
         const includeBlocked = filter?.includeBlocked ?? false;
-        const policyRules = yield* listActivePolicyRuleSet();
+        const policyEvaluator = yield* makeToolPolicyEvaluator();
         // Only tools whose integration is still in the catalog. A tool row
         // whose integration was removed is an orphan (a removal that could
         // not reach this subject's rows): listing it invites an invoke that
           const tool = rowToTool(row);
           if (!matchesToolFilter(tool, filter)) continue;
           if (!includeBlocked) {
-            const effective = yield* resolvePolicyFromRuleSet(
+            const effective = yield* policyEvaluator.resolve({
-              normalizedPolicyId(tool),
+              toolId: normalizedPolicyId(tool),
-              policyRules,
+              defaultRequiresApproval: tool.annotations?.requiresApproval,
-              tool.annotations?.requiresApproval,
+            });
-            );
             if (effective.action === "block") continue;
           }
           tools.push(tool);
           const tool = staticToolToTool(entry);
           if (!matchesToolFilter(tool, filter)) continue;
           if (!includeBlocked) {
-            const effective = yield* resolvePolicyFromRuleSet(
+            const effective = yield* policyEvaluator.resolve({
-              normalizedPolicyId(tool),
+              toolId: normalizedPolicyId(tool),
-              policyRules,
+              defaultRequiresApproval: tool.annotations?.requiresApproval,
-              tool.annotations?.requiresApproval,
+            });
-            );
             if (effective.action === "block") continue;
           }
           tools.push(tool);
       address: ToolAddress,
     ): Effect.Effect<ToolSchemaView | null, StorageFailure> =>
       Effect.gen(function* () {
-        const policyRules = yield* listActivePolicyRuleSet();
+        const policyEvaluator = yield* makeToolPolicyEvaluator();
         const staticEntry = staticTools.get(String(address));
         if (staticEntry) {
           const tool = staticToolToTool(staticEntry);
-          const effective = yield* resolvePolicyFromRuleSet(
+          const effective = yield* policyEvaluator.resolve({
-            normalizedPolicyId(tool),
+            toolId: normalizedPolicyId(tool),
-            policyRules,
+            defaultRequiresApproval: tool.annotations?.requiresApproval,
-            tool.annotations?.requiresApproval,
+          });
-          );
           if (effective.action === "block") return null;
           const preview = yield* Effect.tryPromise({
             try: () =>
         });
         if (!row) return null;
         const tool = rowToTool(row);
-        const effective = yield* resolvePolicyFromRuleSet(
+        const effective = yield* policyEvaluator.resolve({
-          normalizedPolicyId(tool),
+          toolId: normalizedPolicyId(tool),
-          policyRules,
+          defaultRequiresApproval: tool.annotations?.requiresApproval,
-          tool.annotations?.requiresApproval,
+        });
-        );
         if (effective.action === "block") return null;
         const runtime = runtimes.get(row.plugin_id);
       });
     // ------------------------------------------------------------------
-    // Policies — owner-ranked (user=0 inner, org=1 outer).
+    // Policies — CRUD over the stored rows. LIST ordering follows the
+    // product's owner precedence; how rules RESOLVE into an effective
+    // decision is the product's `ExecutorAccess.toolPolicy` hook.
     // ------------------------------------------------------------------
-    const ownerRankForRow = (row: { readonly owner: string }): number =>
+    const ownerListRank = (row: { readonly owner: string }): number => {
-      row.owner === "user" ? 0 : 1;
+      const rank = accessOwners.indexOf(row.owner as Owner);
+      return rank === -1 ? accessOwners.length : rank;
+    };
     // Tool policies gate by tool identity (`<integration>.<tool>`), independent of
     // which connection serves it; the org/user split is handled by owner-scoped
         .pipe(
           Effect.map((rows) =>
             [...rows]
-              .sort((a, b) => ownerRankForRow(a) - ownerRankForRow(b) || comparePolicyRow(a, b))
+              .sort((a, b) => ownerListRank(a) - ownerListRank(b) || comparePolicyRow(a, b))
               .map(rowToToolPolicy),
           ),
         );
             requiresApproval = annotations?.requiresApproval;
           }
         }
-        return resolveEffectivePolicy(toolId, policyRows, ownerRankForRow, requiresApproval);
+        // The stored-rules surface: this deliberately resolves the WORKSPACE
+        // rules a settings UI edits — a session capability allowlist (the
+        // plugin provider) is a different question and is not consulted here.
+        const evaluator = yield* access.toolPolicy({
+          policyRows: Effect.succeed(policyRows),
+          provider: null,
+        });
+        return yield* evaluator.resolve({ toolId, defaultRequiresApproval: requiresApproval });
       });
     // ------------------------------------------------------------------
         }
       });
+    // An approval pause can outlive its pre-pause snapshot by minutes or
+    // days: an admin may rewrite policies while the call waits on a human.
+    // The granted approval stays granted — it is never asked again — but the
+    // decision to RUN must be fresh, so after an accepted approval the
+    // effective policy is re-resolved from the live rule source before any
+    // credential is resolved or handler executes. A rule that now BLOCKS the
+    // tool wins over the stale snapshot; a fresh `require_approval` is
+    // already satisfied by the approval that was just granted. Callers that
+    // retained storage rows across the pause re-read those themselves.
+    const recheckPolicyAfterApproval = (
+      toolId: string,
+      address: ToolAddress,
+      defaultRequiresApproval: boolean | undefined,
+    ): Effect.Effect<void, ToolBlockedError | StorageFailure> =>
+      Effect.gen(function* () {
+        const policyEvaluator = yield* makeToolPolicyEvaluator();
+        const fresh = yield* policyEvaluator.resolve({ toolId, defaultRequiresApproval });
+        if (fresh.action === "block") {
+          return yield* new ToolBlockedError({
+            address,
+            pattern: fresh.pattern ?? "*",
+          });
+        }
+      });
     // ------------------------------------------------------------------
     // execute — the invoke path.
     // ------------------------------------------------------------------
         // not the 5-segment dynamic form.
         const staticEntry = staticTools.get(String(address));
         if (staticEntry) {
-          const policyRules = yield* listActivePolicyRuleSet();
+          const policyEvaluator = yield* makeToolPolicyEvaluator();
-          const policy = yield* resolvePolicyFromRuleSet(
+          const policy = yield* policyEvaluator.resolve({
-            String(address),
+            toolId: String(address),
-            policyRules,
+            defaultRequiresApproval: staticEntry.tool.annotations?.requiresApproval,
-            staticEntry.tool.annotations?.requiresApproval,
+          });
-          );
           if (policy.action === "block") {
             return yield* new ToolBlockedError({
               address,
             });
           }
           yield* enforceApproval(staticEntry.tool.annotations, address, args, policy, handler);
+          if (approvalRequired(staticEntry.tool.annotations, policy)) {
+            yield* recheckPolicyAfterApproval(
+              String(address),
+              address,
+              staticEntry.tool.annotations?.requiresApproval,
+            );
+          }
           return yield* wrapInvocationError(
             staticEntry.tool.handler({
               ctx: staticEntry.ctx,
           }),
           { startImmediately: true },
         );
-        const policyRulesFiber = yield* Effect.forkChild(listActivePolicyRuleSet());
+        const policyEvaluatorFiber = yield* Effect.forkChild(makeToolPolicyEvaluator());
         const connectionRowFiber = yield* Effect.forkChild(
           findConnectionRow({
             owner: parsed.owner,
           // Resolve policy (owner-ranked).
           const toolForPolicy = rowToTool(row);
-          const policyRules = yield* Fiber.join(policyRulesFiber);
+          const policyEvaluator = yield* Fiber.join(policyEvaluatorFiber);
           const annotations = decodeJsonColumn(row.annotations) as ToolAnnotations | undefined;
-          const policy = yield* resolvePolicyFromRuleSet(
+          const policy = yield* policyEvaluator.resolve({
-            normalizedPolicyId(toolForPolicy),
+            toolId: normalizedPolicyId(toolForPolicy),
-            policyRules,
+            defaultRequiresApproval: annotations?.requiresApproval,
-            annotations?.requiresApproval,
+          });
-          );
           if (policy.action === "block") {
             return yield* new ToolBlockedError({
               address,
           }
           yield* enforceApproval(resolvedAnnotations, address, args, policy, handler);
+          // Fresh decisions after the pause (see `recheckPolicyAfterApproval`):
+          // besides the policy, re-read the rows this call retained across
+          // the approval. A connection or tool removed while the call waited
+          // on a human must fail as not-found here — before any credential
+          // is resolved — not execute against rows that no longer exist.
+          let approvedToolRow = row;
+          let approvedConnectionRow = connectionRow;
+          if (approvalRequired(resolvedAnnotations, policy)) {
+            yield* recheckPolicyAfterApproval(
+              normalizedPolicyId(toolForPolicy),
+              address,
+              resolvedAnnotations?.requiresApproval,
+            );
+            const freshToolRow = yield* core.findFirst("tool", {
+              where: (b: AnyCb) =>
+                b.and(
+                  byOwner(parsed.owner)(b),
+                  b("integration", "=", String(parsed.integration)),
+                  b("connection", "=", String(parsed.connection)),
+                  b("name", "=", String(parsed.tool)),
+                ),
+              select: TOOL_INVOCATION_COLUMNS,
+            });
+            if (!freshToolRow) {
+              return yield* new ToolNotFoundError({ address });
+            }
+            // The plugin runtime and handler were bound to the PRE-pause row.
+            // If the integration was torn down and re-registered under a
+            // different plugin while the call waited, the tool the user
+            // approved no longer exists in that form — fail as not-found
+            // rather than hand the replacement row to the old plugin.
+            if (freshToolRow.plugin_id !== row.plugin_id) {
+              return yield* new ToolNotFoundError({ address });
+            }
+            approvedToolRow = freshToolRow;
+            const freshConnectionRow = yield* findConnectionRow({
+              owner: parsed.owner,
+              integration: parsed.integration,
+              name: parsed.connection,
+            });
+            if (!freshConnectionRow) {
+              return yield* new ConnectionNotFoundError({
+                owner: parsed.owner,
+                integration: parsed.integration,
+                name: parsed.connection,
+              });
+            }
+            approvedConnectionRow = freshConnectionRow;
+          }
           // Resolve every named credential input (`variable → value`); `value` is
           // the primary `token` for single-input + OAuth callers. The
           // integration-row read is independent of credential resolution, so
           // integration read cannot gate the credential error and a failed
           // one is deliberately abandoned, never silently dropped as an
           // unobserved value.
-          const valuesFiber = yield* Effect.forkChild(resolveConnectionValues(connectionRow), {
+          const valuesFiber = yield* Effect.forkChild(
-            startImmediately: true,
+            resolveConnectionValues(approvedConnectionRow),
-          });
+            {
+              startImmediately: true,
+            },
+          );
           const integrationRowFiber = yield* Effect.forkChild(
             findIntegrationRow(parsed.integration),
           );
           if (!integrationRow) {
             return yield* new IntegrationNotFoundError({ slug: parsed.integration });
           }
-          const grantedScopes = grantedScopesFromRow(connectionRow);
+          const grantedScopes = grantedScopesFromRow(approvedConnectionRow);
           const invokeTool = runtime.plugin.invokeTool;
           const invokeWith = (
             resolved: Record<string, string | null>,
               owner: parsed.owner,
               integration: parsed.integration,
               connection: parsed.connection,
-              template: AuthTemplateSlug.make(connectionRow.template),
+              template: AuthTemplateSlug.make(approvedConnectionRow.template),
               value: resolved[PRIMARY_INPUT_VARIABLE] ?? null,
               values: resolved,
               config: decodeJsonColumn(integrationRow.config),
             return wrapInvocationError(
               invokeTool({
                 ctx: runtime.ctx,
-                toolRow: row,
+                toolRow: approvedToolRow,
                 credential,
                 args,
                 elicit: buildElicit(address, args, handler),
           // guidance rather than a masked one.
           const { result, usedValues } = yield* Effect.gen(function* () {
             if (!isUnauthorizedToolFailure(first)) return { result: first, usedValues: values };
-            const refreshed = yield* forceRefreshConnectionValues(connectionRow).pipe(
+            const refreshed = yield* forceRefreshConnectionValues(approvedConnectionRow).pipe(
               // A failed re-mint is not this call's failure to report: the upstream
               // already produced an auth failure with recovery guidance, which is
               // strictly more actionable than a refresh-plumbing error. Keep it.
               usedValues: refreshed,
             };
           });
-          yield* healPersistedHealthOnUse(connectionRow, result, usedValues);
+          yield* healPersistedHealthOnUse(approvedConnectionRow, result, usedValues);
           return result;
         });
         // Interrupting an already-completed (or already-joined) fiber is a
         // so an interruption that lands before the join reaches it promptly.
         return yield* Effect.ensuring(
           invokeDynamicTool,
-          Fiber.interruptAll([toolRowFiber, policyRulesFiber, connectionRowFiber]),
+          Fiber.interruptAll([toolRowFiber, policyEvaluatorFiber, connectionRowFiber]),
         );
       }).pipe(
         // Expected tool failures (`ToolResult.fail`) resolve through the
     // register credential providers.
     // ------------------------------------------------------------------
+    // IDENTITY partitions, deliberately NOT narrowed by `access.owners`:
+    // these name where the binding's identity lives, while WHICH of them a
+    // plugin blob store may read or write is the separate product decision
+    // (`BlobAccess`) applied per store below. Identity-bound consumers keep
+    // the full shape — see the pending-approval store.
     const blobPartitions: OwnerPartitions = {
       org: `o:${tenant}`,
       user: subject != null ? `u:${tenant}:${subject}` : null,
     };
-    // Pending approvals file under the narrowest partition this executor has:
+    // Pending approvals file under the narrowest IDENTITY partition this
-    // a subject-bound executor keeps them private to that member, and a pure-org
+    // executor has: a subject-bound executor keeps them private to that
-    // executor (no subject) files them at the org. Either way the partition IS
+    // member, and a pure-org executor (no subject) files them at the org.
-    // the ownership check — another caller's executor reads a different
+    // The partition IS the ownership check — another caller's executor reads
-    // namespace and simply does not see the record.
+    // a different namespace and simply does not see the record. CONTINUATION
+    // IDENTITY, not resource visibility: this routing must never follow the
+    // product's narrowed `access.owners` view — rerouting an org-only
+    // member's approvals into the SHARED org namespace would let any
+    // coworker's binding consume them.
     const pendingApprovals = makePendingApprovalStore(
       blobs,
       blobPartitions.user ?? blobPartitions.org,
         core,
         pluginId: plugin.id,
         owner: ownerBinding,
+        readOwners: accessOwners,
       });
       const storageDeps: StorageDeps = {
         owner: ownerBinding,
-        blobs: pluginBlobStore(blobs, blobPartitions, plugin.id),
+        blobs: pluginBlobStore(blobs, blobPartitions, plugin.id, {
+          owners: accessOwners,
+          storageWrites: access.capabilities.storageWrites,
+        }),
         pluginStorage,
       };
       const storage = plugin.storage(storageDeps);
     // Default OFF: without the opt-in there is no `admin` key at all, so the
     // tenant-wide handle is never even constructed.
-    const admin = config.platformView === true ? makeAdmin() : undefined;
+    const admin = access.capabilities.adminReads ? makeAdmin() : undefined;
     // ------------------------------------------------------------------
     // close

packages/core/sdk/src/index.ts+12−3

   ownerForItemId,
 } from "./provider-item-owner";
-// Tool policies.
+// Tool policies — vocabulary + matching/placement utilities. Resolution
+// semantics live in `@executor-js/product-access/policy`.
 export {
   matchPattern,
   isValidPattern,
-  effectivePolicyFromSorted,
+  comparePolicyRow,
   ToolPolicyActionSchema,
   type ToolPolicy,
   type CreateToolPolicyInput,
 export {
   CurrentOrgWriteAccess,
   currentOrgWriteAccess,
+  executorAccessViolation,
   makeOrgWriteAccessState,
+  type AccessDecision,
+  type ExecutorAccess,
+  type ExecutorAccessCapabilities,
   type OrgWriteAccess,
   type OrgWriteAccessState,
-} from "./org-write-access";
+  type SettingsWriteTarget,
+  type ToolPolicyEvaluationInput,
+  type ToolPolicyEvaluator,
+  type ToolPolicySources,
+} from "./access";
 // CLI / runtime config.
 export {

packages/core/sdk/src/integration-removal-cascade.test.ts+9−3

 import { definePlugin } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import { makeTestConfig } from "./testing";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Removing an integration must cascade to EVERY member's rows under it, not
 const setup = () =>
   Effect.gen(function* () {
-    const config = makeTestConfig({ plugins: [demoPlugin] as const, subject: ALICE });
+    const config = makeTestConfig({
+      access: testAccess.member(),
+      plugins: [demoPlugin] as const,
+      subject: ALICE,
+    });
     const alice = yield* createExecutor(config);
     const bob = yield* createExecutor({
       ...config,
   it.effect("a member (org writes denied) still cannot remove", () =>
     Effect.gen(function* () {
       const { config } = yield* setup();
-      const member = yield* createExecutor({ ...config, orgWrites: "denied" });
+      const member = yield* createExecutor({ ...config, access: testAccess.member("denied") });
       yield* Effect.addFinalizer(() => member.close().pipe(Effect.ignore));
       const error = yield* Effect.flip(member.integrations.remove(INTEG));
       expect(Predicate.isTagged("OrgWriteDeniedError")(error)).toBe(true);
   it.effect("the platform view cannot remove (read-only holds ahead of the cascade)", () =>
     Effect.gen(function* () {
       const { config } = yield* setup();
-      const platform = yield* createExecutor({ ...config, platformView: true });
+      const platform = yield* createExecutor({ ...config, access: testAccess.platform() });
       yield* Effect.addFinalizer(() => platform.close().pipe(Effect.ignore));
       yield* platform.integrations.remove(INTEG).pipe(
         Effect.flatMap(() => Effect.die("expected the platform view to refuse the removal")),
           withQueryContext(config.testDb.db, {
             tenant: String(config.tenant),
             subject: BOB,
+            owners: ["user", "org"],
           }).findMany("tool", {}),
         );
         expect(stored.map((row) => String(row.integration)).sort()).toEqual([

packages/core/sdk/src/oauth-ema-lifecycle.test.ts+25−6

 import { definePlugin } from "./plugin";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { serveOAuthTestServer, type OAuthTestServerShape } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEG = IntegrationSlug.make("acme");
 const TEMPLATE = AuthTemplateSlug.make("oauth");
     Effect.scoped(
       Effect.gen(function* () {
         const servers = yield* enterpriseServers({});
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);
     Effect.scoped(
       Effect.gen(function* () {
         const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);
         yield* executor.oauth.start(startEnterpriseConnect(servers));
     Effect.scoped(
       Effect.gen(function* () {
         const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);
         yield* executor.oauth.start(startEnterpriseConnect(servers));
     Effect.scoped(
       Effect.gen(function* () {
         const servers = yield* enterpriseServers({ resourceTokenExpiresInSeconds: 1 });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);
         yield* executor.oauth.start(startEnterpriseConnect(servers));
             errorDescription: "This client is not approved for the requested MCP server.",
           },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);
     Effect.scoped(
       Effect.gen(function* () {
         const servers = yield* enterpriseServers({ advertiseProfile: false });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* registerClients(executor.oauth.createClient, servers);

packages/core/sdk/src/oauth-ema-rollout.test.ts+2−0

 import { definePlugin } from "./plugin";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { serveOAuthTestServer, type OAuthTestServerShape } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEG = IntegrationSlug.make("acme");
 const TEMPLATE = AuthTemplateSlug.make("oauth");
 const harness = (rollout: EnterpriseManagedRollout | undefined) =>
   makeTestWorkspaceHarness({
+    access: testAccess.member(),
     plugins,
     tenant: TENANT,
     subject: SUBJECT,

packages/core/sdk/src/oauth-first-party.test.ts+15−1

 import { definePlugin } from "./plugin";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { scopesFromAuthorizeUrl, serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // First-party OAuth clients: host-operated apps declared in executor config
 // (`firstPartyOAuthClients`), addressed as `first-party:<name>`. Resolved from
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
           const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
             plugins,
             firstPartyOAuthClients: [firstPartyClientFor(server)],
           });
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["repo"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [{ ...firstPartyClientFor(server), authorizationScopes: [] }],
         });
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read", "offline_access"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [
             {
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const harness = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [firstPartyClientFor(server)],
         });
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [
             {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         let enabled = true;
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           subject: "review-user",
           tenant: "review-org",
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const harness = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [
             {
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read", "write"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [{ ...firstPartyClientFor(server), allowedScopes: ["read"] }],
         });
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [firstPartyClientFor(server)],
         });
     Effect.scoped(
       Effect.gen(function* () {
         yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const error = yield* executor.oauth
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           firstPartyOAuthClients: [firstPartyClientFor(server)],
         });

packages/core/sdk/src/oauth-flow.test.ts+116−30

 import { makeTestConfig, makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { ToolResult } from "./tool-result";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // Milestone 2: prove the v2 `oauth.start` / `oauth.complete` token-minting flow
 // and OAuth access-token refresh end to end against the test authorization
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           yield* executor.oauth.createClient({
         }))();
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin(), slowOAuthPlugin] as const,
           waitUntil: (promise) => keptAlive.push(promise),
         });
           scopes: ["read"],
           defaultTokenEndpointAuthMethod: "client_secret_basic",
         });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
           scopes: ["read"],
           defaultTokenEndpointAuthMethod: "client_secret_basic",
         });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           oauthCallbackStateOrgSlug: "acme",
         });
           scopes: ["offline_access", "read"],
           omitTokenResponseScopes: ["offline_access"],
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["offline_access", "read"]);
         yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "read"],
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "read"],
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "read"],
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "read"],
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "read"],
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         yield* executor.oauth.createClient({
           idTokenClaims: { email: "alice@example.com", sub: "user-1" },
           refreshIdTokenClaims: { email: "refreshed@example.com", sub: "user-2" },
         });
-        const harness = yield* makeTestWorkspaceHarness({ plugins });
+        const harness = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
         const { executor, config } = harness;
         yield* executor.acme.seed(["openid", "email", "profile", "read"]);
         // is no silent localhost default. The redirect flow must fail loudly
         // rather than handing the provider a wrong `http://127.0.0.1/callback`.
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           redirectUri: null,
         });
         // No redirectUri configured, but client_credentials never redirects —
         // it must still mint the connection inline.
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           redirectUri: null,
         });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer();
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
           owner: "org",
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           // The app is registered under the WORKSPACE (org) — "shared with
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         // A PRIVATE app owned by the member.
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         // Deliberately NOT seeded: the slug names nothing in the catalog — the
         // shape of a reconnect against a connection whose integration was
         // removed, or an agent replaying a stale slug.
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const harness = yield* makeTestWorkspaceHarness({ plugins });
+        const harness = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
         const { executor, config } = harness;
         yield* executor.acme.seed();
         // One database handle and one credential store under two execution
         // stacks — what a self-host holds while two MCP sessions are open.
-        const config = { ...makeTestConfig({ plugins }), fetch: park.fetch };
+        const config = {
+          ...makeTestConfig({ access: testAccess.member(), plugins }),
+          fetch: park.fetch,
+        };
         const sessionA = yield* createExecutor(config);
         const sessionB = yield* createExecutor(config);
         yield* Effect.addFinalizer(() => sessionA.close().pipe(Effect.ignore));
           // the store layer and mask the gate-key collision this test is about.
           const pluginsA = [memoryCredentialsPlugin(), oauthPlugin] as const;
           const pluginsB = [memoryCredentialsPlugin(), oauthPlugin] as const;
-          const shared = makeTestConfig({ plugins: pluginsA, tenant: "a", subject: "user:b" });
+          const shared = makeTestConfig({
+            access: testAccess.member(),
+            plugins: pluginsA,
+            tenant: "a",
+            subject: "user:b",
+          });
           const configA = { ...shared, fetch: parkA.fetch };
           const configB = {
             ...shared,
           // Expire BOTH rows so both tenants must refresh. `shared.db` is bound
           // to tenant A; tenant B's partition needs its own scoped handle.
-          const dbB = withQueryContext(shared.testDb.db, { tenant: "a:user", subject: "b" });
+          const dbB = withQueryContext(shared.testDb.db, {
+            tenant: "a:user",
+            subject: "b",
+            owners: ["user", "org"],
+          });
           yield* Effect.promise(() =>
             shared.db.updateMany("connection", {
               where: (b) => b("name", "=", "mine"),
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const park = makeTokenRequestPark();
-        const config = { ...makeTestConfig({ plugins }), fetch: park.fetch };
+        const config = {
+          ...makeTestConfig({ access: testAccess.member(), plugins }),
+          fetch: park.fetch,
+        };
         const sessionA = yield* createExecutor(config);
         const sessionB = yield* createExecutor(config);
         yield* Effect.addFinalizer(() => sessionA.close().pipe(Effect.ignore));
           // handle, which is what the extra `withQueryContext` wrapper is.
           const config = {
             ...makeTestConfig({
+              access: testAccess.member(),
               plugins: [oauthPlugin] as const,
               tenant: SHARED_STORE_TENANT,
               subject: SHARED_STORE_SUBJECT,
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const harness = yield* makeTestWorkspaceHarness({ plugins });
+          const harness = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
           const { executor, config } = harness;
           yield* executor.acme.seed();
           tokenExpiresInSeconds: 0,
           invalidRefreshTokenDescription: "Grant not found",
         });
-        const harness = yield* makeTestWorkspaceHarness({ plugins });
+        const harness = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
         const { executor, config } = harness;
         yield* executor.acme.seed();
           tokenExpiresInSeconds: 0,
           invalidRefreshTokenDescription: "Grant revoked",
         });
-        const harness = yield* makeTestWorkspaceHarness({ plugins });
+        const harness = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
         const { executor, config } = harness;
         yield* executor.acme.seed();
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           yield* executor.oauth.createClient({
           scopes: ["openid", "email", "profile", "offline_access", "read", "write"],
           omitTokenResponseScopes: ["email", "profile", "write"],
         });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed([
           "openid",
           "email",
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read", "write"] });
-          const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor, config } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed(["read", "write"]);
           yield* executor.oauth.createClient({
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor, config } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           // Reroute the https regional/advertised hosts back to the loopback test
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const tokenCalls: TokenEndpointCall[] = [];
       return issued.length > 0 ? issued[issued.length - 1]! : null;
     });
     const harness = yield* makeTestWorkspaceHarness({
+      access: testAccess.member(),
       plugins: [memoryCredentialsPlugin(), makeRejectingPlugin(state)] as const,
     });
     const { executor, config } = harness;
         }))();
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin(), forbiddenPlugin] as const,
         });
         yield* executor.acme.seed();
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         // `resource: null` — explicitly none, not merely unset.
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({

packages/core/sdk/src/oauth-list-clients.test.ts+19−4

 import { OAuthClientSlug } from "./ids";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
+import { testAccess } from "@executor-js/product-access/testing";
 // listClients returns metadata-only summaries of the clients visible to the
 // caller — the tenant's org clients plus the caller's own user clients — and
   it.effect("rejects metadata URLs persisted as authorization URLs", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         const error = yield* Effect.flip(
           executor.oauth.createClient({
   it.effect("returns owner-visible clients as summaries without the secret", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.oauth.createClient({
           owner: "org",
   it.effect("rejects HTTP Basic authentication without a client secret", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         const error = yield* Effect.flip(
           executor.oauth.createClient({
         const tenant = "shared-tenant";
         const a = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-a",
         });
         const b = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-b",
   it.effect("classifies legacy MCP DCR-looking clients as dynamic registration", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { config, executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { config, executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.oauth.createClient({
           owner: "org",

packages/core/sdk/src/oauth-register-dynamic.test.ts+62−16

 import { definePlugin } from "./plugin";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // RFC 7591 Dynamic Client Registration, end to end:
 //   probe → registerDynamicClient (no pasted client id/secret) → listClients
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { executor } = yield* makeTestWorkspaceHarness({
           plugins,
-          orgWrites: "denied",
+          access: testAccess.member("denied"),
         });
         const error = yield* executor.oauth
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         // Probe surfaces the registration endpoint + advertised auth methods so
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
         // reused, so a fresh DCR registration happens. The GC migration then
         // backfills/GCs any duplicate this transient window mints.
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { config, executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { config, executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
         const legacySlug = OAuthClientSlug.make("cloudflare-mcp");
         const server = yield* serveOAuthTestServer({
           scopes: ["openid", "offline_access"],
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.registerDynamicClient({
         // row's origin_issuer, the reuse lookup keys on it and mints no
         // duplicate. This is the steady state the migration establishes.
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { config, executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { config, executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
         const legacySlug = OAuthClientSlug.make("cloudflare-mcp");
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
         const resourceA = `${server.issuerUrl}/mcp/a`;
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
         const resourceA = `${server.issuerUrl}/mcp/a`;
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
       Effect.scoped(
         Effect.gen(function* () {
           const server = yield* serveOAuthTestServer({ scopes: ["read"] });
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
           // Mirror Mercury: reject any client_name containing the brand.
           approveClientName: (name) => !name.includes("Acme"),
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
           scopes: ["read"],
           approveClientName: () => false,
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
           approveRedirectUri: (uri) =>
             uri.startsWith("http://localhost") || uri.startsWith("http://127."),
         });
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
             scopes: ["read"],
             approveRedirectUri: () => false, // reject every redirect URI, even loopback
           });
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });

packages/core/sdk/src/oauth-remove-client.test.ts+24−3

 import { definePlugin } from "./plugin";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // removeClient permanently deletes an owner-scoped oauth_client row, keyed by
 // (owner, slug). The owner policy on `oauth_client` prevents removing another
   it.effect("removes a client so it no longer lists", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.oauth.createClient({
           owner: "user",
   it.effect("is idempotent — removing a non-existent client succeeds", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         // No client was ever created; removing it must not error.
         yield* executor.oauth.removeClient("user", OAuthClientSlug.make("never-existed"));
   it.effect("removing an org client leaves a user client intact (and vice versa)", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.oauth.createClient({
           owner: "org",
         const tenant = "shared-tenant";
         const a = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-a",
         });
         const b = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-b",
         const tenant = "shared-tenant";
         const a = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-a",
         });
         const b = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-b",
     Effect.scoped(
       Effect.gen(function* () {
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           coreTools: {},
         });
       Effect.gen(function* () {
         const store = new Map<string, string>();
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [txPlugin(store)] as const,
         });
         yield* executor.oauth.createClient(userClient("user-secret"));
       Effect.gen(function* () {
         const store = new Map<string, string>();
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [txPlugin(store)] as const,
         });
         yield* executor.oauth.createClient(userClient("user-secret"));
       Effect.gen(function* () {
         const store = new Map<string, string>();
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [txPlugin(store)] as const,
         });
         yield* executor.oauth.createClient(userClient("user-secret"));
         const tenant = "shared-tenant";
         const a = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-a",
         expect(secretValue(store)).toBe("a-secret");
         const b = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-b",
         });
         const store = new Map<string, string>();
         const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [txPlugin(store), integrationPlugin] as const,
           redirectUri: null,
         });

packages/core/sdk/src/oauth-scope-union.test.ts+35−9

 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
 import { serveTestHttpApp } from "./testing";
 import { scopesFromAuthorizeUrl, serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // Integration-driven scopes: at connect, `oauth.start` requests the integration's
 // scopes — its DECLARED oauth scopes when it has any, otherwise the scopes
 ) =>
   Effect.gen(function* () {
     const plugins = [memoryCredentialsPlugin(), makeMcpScopePlugin({ scopes: null })] as const;
-    const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+    const { executor } = yield* makeTestWorkspaceHarness({ access: testAccess.member(), plugins });
     yield* executor.mcp.seed();
     yield* executor.oauth.createClient({
       owner: "org",
             memoryCredentialsPlugin(),
             makeScopePlugin({ scopes: DECLARED_SCOPES }),
           ] as const;
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           // The app is pure identity — no scope set.
             authorizationUrl: `${server.authorizationEndpoint}?optional_scope=${optional.join("+")}`,
           }),
         ] as const;
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
           owner: "org",
           memoryCredentialsPlugin(),
           makeScopePlugin({ scopes: ["calendar", "stale_scope", "drive"] }),
         ] as const;
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
         // `scopes: null` ⇒ the integration declares an oauth method with no
         // template scopes ⇒ declared scopes resolve to [] ⇒ no scope is requested.
         const plugins = [memoryCredentialsPlugin(), makeScopePlugin({ scopes: null })] as const;
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
           memoryCredentialsPlugin(),
           makeScopePlugin({ scopes: ["file_content:read", "file_comments:write"] }),
         ] as const;
-        const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+        const { executor } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
+          plugins,
+        });
         yield* executor.acme.seed();
         yield* executor.oauth.createClient({
               { discoversScopes: true, discoveryUrl: server.mcpResourceUrl },
             ),
           ] as const;
-          const { executor } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.mcp.seed();
           // No `resource` on the client — the wire parameter is absent by
             makeMcpScopePlugin({ scopes: null }),
           ] as const;
           const { executor } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
             plugins,
             firstPartyOAuthClients: [
               {
             memoryCredentialsPlugin(),
             makeScopePlugin({ scopes: DECLARED_SCOPES }),
           ] as const;
-          const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor, config } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.acme.seed();
           // A client_credentials client so `start` mints inline (no redirect),
             memoryCredentialsPlugin(),
             makeMcpScopePlugin({ scopes: null }),
           ] as const;
-          const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
+          const { executor, config } = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            plugins,
+          });
           yield* executor.mcp.seed();
           yield* executor.oauth.createClient({

packages/core/sdk/src/oauth-service.ts+3−3

@@ -232,9 +232,9 @@ export interface OAuthServiceDeps { · 231 unmodified lines
232	readonly owner: Owner;	232	readonly owner: Owner;
233	readonly subject: string;	233	readonly subject: string;
234	};	234	};
235	/** Workspace-settings gate from the executor binding	235	/** Settings gate from the executor binding (`ExecutorAccess.settingsWrite`):
236	* (`ExecutorConfig.orgWrites`): refuses `owner: "org"` targets on the	236	* enforces the product's decision for the owner targeted by a user-intent
237	* user-intent client/connect surfaces. */	237	* client/connect operation. */
238	readonly guardOrgWrite: (owner: Owner) => Effect.Effect<void, OrgWriteDeniedError>;	238	readonly guardOrgWrite: (owner: Owner) => Effect.Effect<void, OrgWriteDeniedError>;
239	readonly defaultWritableProvider: () => CredentialProvider \| null;	239	readonly defaultWritableProvider: () => CredentialProvider \| null;
240	/** Write the connection row with OAuth lifecycle fields + produce its tools. */	240	/** Write the connection row with OAuth lifecycle fields + produce its tools. */

packages/core/sdk/src/oauth-session-cleanup.test.ts+6−0

 import { definePlugin } from "./plugin";
 import { makeTestConfig, makeTestWorkspaceHarness } from "./test-config";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // An in-flight authorization flow parks its PKCE verifier in `oauth_session` in
 // plaintext, which is fine while the flow can still spend it. What is not fine is
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({});
         const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin, acmePlugin] as const,
         });
         yield* executor.acme.seed();
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({});
         const { executor, config } = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin, acmePlugin] as const,
         });
         yield* executor.acme.seed();
         const plugins = [memoryCredentialsPlugin, acmePlugin] as const;
         const a = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-a",
         // A second member of the same tenant, on the same database.
         const b = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "subject-b",
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({});
         const base = makeTestConfig({
+          access: testAccess.member(),
           plugins: [memoryCredentialsPlugin, acmePlugin] as const,
         });
         const executor = yield* createExecutor({

packages/core/sdk/src/org-write-access.ts+0−33

@@ -1,33 +0,0 @@
1	import { Context, Effect, Ref } from "effect";
2
3	/** Workspace-settings authorization bound to the currently executing request. */
4	export type OrgWriteAccess = "allowed" \| "denied";
5
6	/**
7	* Fiber-local workspace-settings authorization for request-bound executors.
8	*
9	* The denied default makes a missing request binding fail closed. Non-session
10	* executors continue to use their explicit {@link ExecutorConfig.orgWrites}
11	* value (or the allowed default) and never consult this reference.
12	*/
13	export interface OrgWriteAccessState {
14	/** Mutable value inherited by a detached execution and refreshed on resume. */
15	readonly current: Ref.Ref<OrgWriteAccess>;
16	}
17
18	/** Create an isolated request/execution authorization state. */
19	export const makeOrgWriteAccessState = (access: OrgWriteAccess): OrgWriteAccessState => ({
20	current: Ref.makeUnsafe(access),
21	});
22
23	/** Request-local workspace-write authorization inherited by child fibers. */
24	export const CurrentOrgWriteAccess = Context.Reference<OrgWriteAccessState>(
25	"@executor-js/sdk/CurrentOrgWriteAccess",
26	{ defaultValue: () => makeOrgWriteAccessState("denied") },
27	);
28
29	/** Read the effective authorization at a workspace-write sink. */
30	export const currentOrgWriteAccess: Effect.Effect<OrgWriteAccess> = Effect.gen(function* () {
31	const state = yield* CurrentOrgWriteAccess;
32	return yield* Ref.get(state.current);
33	});

packages/core/sdk/src/org-writes.test.ts+22−12

   ToolName,
 } from "./ids";
 import { createExecutor } from "./executor";
-import { CurrentOrgWriteAccess, makeOrgWriteAccessState } from "./org-write-access";
+import { CurrentOrgWriteAccess, makeOrgWriteAccessState } from "./access";
 import { definePlugin } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import { makeTestConfig } from "./testing";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
-// `ExecutorConfig.orgWrites` — the workspace-settings gate.
+// `ExecutorAccess.workspaceWrites` — the workspace-settings gate.
 //
 // A `"denied"` binding (a plain member) may USE workspace resources — read
 // them, execute tools over org connections — but every user-intent
 // `"allowed"` (admins, and hosts with no role model) behaves exactly as before.
 //
 // The fixtures build TWO executors over ONE test database: an admin
-// (default `orgWrites`) that seeds the workspace, and a member
+// (workspace writes allowed) that seeds the workspace, and a member
-// (`orgWrites: "denied"`) that the assertions run against.
+// (workspace writes denied) that the assertions run against.
 // ---------------------------------------------------------------------------
 const memoryProvider = (): CredentialProvider => {
 const setup = () =>
   Effect.gen(function* () {
-    const config = makeTestConfig({ plugins: [demoPlugin] as const });
+    const config = makeTestConfig({ access: testAccess.member(), plugins: [demoPlugin] as const });
     const admin = yield* createExecutor(config);
-    const member = yield* createExecutor({ ...config, orgWrites: "denied" });
+    const member = yield* createExecutor({ ...config, access: testAccess.member("denied") });
     yield* Effect.addFinalizer(() =>
       admin.close().pipe(Effect.andThen(member.close()), Effect.ignore),
     );
     }),
   );
-describe("orgWrites: denied", () => {
+describe("workspace writes denied", () => {
   it.effect("reads a live session binding at every workspace-write sink", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
-        orgWrites: "request",
+        access: testAccess.requestBound(),
       });
       yield* Effect.addFinalizer(() => executor.close().pipe(Effect.ignore));
       const policy = yield* executor.demo.seed().pipe(
   it.effect("allows subjectless system re-registration during boot convergence", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [demoPlugin] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [demoPlugin] as const,
+      });
       const admin = yield* createExecutor(config);
       const { subject: _subject, ...systemConfig } = config;
+      // Boot convergence is the PRODUCT's rule now: the workspace-service
+      // posture allows it. A subject-less binding whose product DENIES
+      // settings writes is refused instead — see settings-authority.test.ts.
       const system = yield* createExecutor({
         ...systemConfig,
-        orgWrites: "denied",
+        access: testAccess.org(),
       });
       yield* Effect.addFinalizer(() =>
         admin.close().pipe(Effect.andThen(system.close()), Effect.ignore),
   );
 });
-describe("orgWrites: default (allowed)", () => {
+describe("workspace writes allowed", () => {
   it.effect("admin bindings mutate workspace-level state as before", () =>
     Effect.gen(function* () {
       const { admin } = yield* setup();

packages/core/sdk/src/owner-policy-reach.test.ts+24−3

       withDb(async (db) => {
         await seedTwoSubjects(db);
-        const bound = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT_A });
+        const bound = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT_A,
+          owners: ["user", "org"],
+        });
         const rows = await bound.findMany("connection", {});
         expect(rows.map((row) => row.name).sort()).toEqual(["a-personal", "shared"]);
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
         const rows = await platform.findMany("connection", {});
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
         const rows = await platform.findMany("connection", {});
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: null,
+          owners: ["org"],
           reach: "tenant",
         });
         const rows = await platform.findMany("connection", {});
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
         const platform = withQueryContext(db.db, {
           tenant: TENANT,
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           reach: "tenant",
         });
       withDb(async (db) => {
         // The guard must not disturb the product view: an ordinary bound
         // context writes exactly as before.
-        const bound = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT_A });
+        const bound = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT_A,
+          owners: ["user", "org"],
+        });
         await bound.create("connection", {
           tenant: TENANT,
           owner: "user",
           subject: SUBJECT_A,
+          owners: ["user", "org"],
           integration: "github",
           name: "written-by-bound-view",
           template: "apiKey",
   it.effect("a bound context still cannot write outside its own subject", () =>
     Effect.promise(() =>
       withDb(async (db) => {
-        const bound = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT_A });
+        const bound = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT_A,
+          owners: ["user", "org"],
+        });
         await expect(
           bound.create("connection", {
             tenant: TENANT,
             owner: "user",
             subject: SUBJECT_B,
+            owners: ["user", "org"],
             integration: "github",
             name: "cross-subject",
             template: "apiKey",

packages/core/sdk/src/owner-policy.ts+60−11

@@ -2,6 +2,7 @@ import { type Condition, type ConditionBuilder } from "@executor-js/fumadb/query · 1 unmodified line
2	import type { AnyColumn, AnyTable } from "@executor-js/fumadb/schema";	2	import type { AnyColumn, AnyTable } from "@executor-js/fumadb/schema";
3		3
4	import { StorageError } from "./fuma-runtime";	4	import { StorageError } from "./fuma-runtime";
		5	import type { Owner } from "./ids";
5		6
6	/* The v2 owner policy — successor to v1's `executor.scope` policy. Every owned	7	/* The v2 owner policy — successor to v1's `executor.scope` policy. Every owned
7	* row carries `tenant` + `owner`('org'\|'user') + `subject`; org rows use the	8	* row carries `tenant` + `owner`('org'\|'user') + `subject`; org rows use the
@@ -53,6 +54,19 @@ export interface ExecutorOwnerPolicyContext { · 45 unmodified lines
53	/** The acting member, or null for a pure-org executor (no `owner:"user"`	54	/** The acting member, or null for a pure-org executor (no `owner:"user"`
54	* reads/writes are allowed when null). */	55	* reads/writes are allowed when null). */
55	readonly subject: string \| null;	56	readonly subject: string \| null;
		57	/**
		58	* The row-visibility/write decision (`ExecutorAccess.owners` for
		59	* principal contexts): which owner partitions this context sees, and may
		60	* create/patch rows in. REQUIRED — there is no full-view default; a
		61	* context that reaches the policy without it fails closed (reads match
		62	* nothing, writes are refused). Host-internal contexts that only touch
		63	* tenant-scoped tables state `[]` explicitly.
		64	*
		65	* This NARROWS, never widens: whatever it lists, the tenant clause and the
		66	* bound-subject clause on user rows still apply, and `reach: "tenant"`
		67	* contexts remain read-only (or delete-only) by construction.
		68	*/
		69	readonly owners: readonly Owner[];
56	/** Read reach; defaults to `"bound"`. A `"tenant"`-reach context is the	70	/** Read reach; defaults to `"bound"`. A `"tenant"`-reach context is the
57	* platform view: it sees the whole tenant but writes exactly as a bound	71	* platform view: it sees the whole tenant but writes exactly as a bound
58	* context does, so it can never mutate another subject's rows. */	72	* context does, so it can never mutate another subject's rows. */
@@ -106,17 +120,29 @@ export const ownerVisibilityCondition = ( · 47 unmodified lines
106	// The platform view: partition by tenant alone. Still never cross-tenant —	120	// The platform view: partition by tenant alone. Still never cross-tenant —
107	// `tenant` is the one clause that is NEVER relaxed, at any reach.	121	// `tenant` is the one clause that is NEVER relaxed, at any reach.
108	if (context.reach === "tenant") return builder("tenant", "=", context.tenant);	122	if (context.reach === "tenant") return builder("tenant", "=", context.tenant);
109	const orgClause = builder.and(	123	// The product's visible partitions. A malformed context that reaches the
110	builder("tenant", "=", context.tenant),	124	// policy without them (only possible past the type system) fails CLOSED:
111	builder("owner", "=", "org"),	125	// no partitions means no rows. Core contributes only the clamps inside
112	);	126	// each clause — never a partition of its own.
113	if (context.subject == null) return orgClause;	127	const owners: readonly Owner[] = Array.isArray(context.owners) ? context.owners : [];
114	const userClause = builder.and(	128	const clauses: (Condition \| boolean)[] = [];
115	builder("tenant", "=", context.tenant),	129	if (owners.includes("org")) {
116	builder("owner", "=", "user"),	130	clauses.push(builder.and(builder("tenant", "=", context.tenant), builder("owner", "=", "org")));
117	builder("subject", "=", context.subject),	131	}
118	);	132	if (owners.includes("user") && context.subject != null) {
119	return builder.or(orgClause, userClause);	133	clauses.push(
		134	builder.and(
		135	builder("tenant", "=", context.tenant),
		136	builder("owner", "=", "user"),
		137	builder("subject", "=", context.subject),
		138	),
		139	);
		140	}
		141	// A context whose product view lists no partition this binding can carry
		142	// (personal-only with no subject) sees nothing — fail closed, not open.
		143	if (clauses.length === 0) return false;
		144	if (clauses.length === 1) return clauses[0]!;
		145	return builder.or(...clauses);
120	};	146	};
121		147
122	/**	148	/**
@@ -172,6 +198,21 @@ export const assertOwnerWritable = ( · 49 unmodified lines
172	if (values.tenant !== ctx.tenant) {	198	if (values.tenant !== ctx.tenant) {
173	policyViolation(`Storage write on table "${tableName}" is outside the executor tenant.`);	199	policyViolation(`Storage write on table "${tableName}" is outside the executor tenant.`);
174	}	200	}
		201	// The product's write partitions: a row may only be created in a partition
		202	// the product view lists (update/delete are already filtered by
		203	// `ownerVisibilityCondition`). A context missing the decision fails
		204	// closed. Purely narrowing — the per-owner clamps below still apply to
		205	// whatever the product allows.
		206	if (!Array.isArray(ctx.owners)) {
		207	policyViolation(
		208	`Storage write on table "${tableName}" is missing the context's owner partitions.`,
		209	);
		210	}
		211	if ((values.owner === "org" \|\| values.owner === "user") && !ctx.owners.includes(values.owner)) {
		212	policyViolation(
		213	`Storage write on table "${tableName}" targets the "${values.owner}" partition, which this product view does not include.`,
		214	);
		215	}
175	if (values.owner === "org") {	216	if (values.owner === "org") {
176	if (values.subject !== ORG_SUBJECT) {	217	if (values.subject !== ORG_SUBJECT) {
177	policyViolation(`Storage write on table "${tableName}" set a subject on an org row.`);	218	policyViolation(`Storage write on table "${tableName}" set a subject on an org row.`);
@@ -204,6 +245,14 @@ export const assertOwnerPatch = ( · 26 unmodified lines
204	if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) {	245	if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) {
205	policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`);	246	policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`);
206	}	247	}
		248	if (
		249	(patch.owner === "org" \|\| patch.owner === "user") &&
		250	!(Array.isArray(ctx.owners) && ctx.owners.includes(patch.owner))
		251	) {
		252	policyViolation(
		253	`Storage write on table "${tableName}" cannot move a row into the "${patch.owner}" partition, which this product view does not include.`,
		254	);
		255	}
207	if (patch.owner === "user" && (ctx.subject == null \|\| patch.subject !== ctx.subject)) {	256	if (patch.owner === "user" && (ctx.subject == null \|\| patch.subject !== ctx.subject)) {
208	policyViolation(	257	policyViolation(
209	`Storage write on table "${tableName}" cannot move a row outside the bound subject.`,	258	`Storage write on table "${tableName}" cannot move a row outside the bound subject.`,

packages/core/sdk/src/platform-view.test.ts+7−1

 } from "./ids";
 import { definePlugin } from "./plugin";
 import { resetSubjectTouchCache, touchSubject } from "./subject-registry";
+import { testAccess } from "@executor-js/product-access/testing";
 // The platform view: `executor.admin`, an OPT-IN read-only surface that reads
 // across every subject in the tenant. Written against the real SQLite bring-up
     db: db.db,
     plugins: [providerPlugin],
     onElicitation: "accept-all",
-    ...(options?.platformView === false ? {} : { platformView: true }),
+    access:
+      options?.platformView === false
+        ? options?.subject === null
+          ? testAccess.org()
+          : testAccess.member()
+        : testAccess.platform({ subject: options?.subject !== null }),
   }).pipe(Effect.orDie);
 const requireAdmin = (executor: Executor) => {

packages/core/sdk/src/plugin-after-commit.test.ts+5−3

 import { definePlugin } from "./plugin";
 import { makeTestExecutor } from "./test-config";
 import { serveOAuthTestServer } from "./testing/oauth-test-server";
+import { testAccess } from "@executor-js/product-access/testing";
 // A plugin's `removeConnection` runs INSIDE core's removal transaction, which is
 // what makes its database work atomic with the row deletions. The same property
   })();
 const setup = (revoked: string[]) =>
-  makeTestExecutor({ plugins: [revokingPlugin(revoked)] as const }).pipe(
+  makeTestExecutor({
-    Effect.tap((executor) => executor.demo.seed()),
+    access: testAccess.member(),
-  );
+    plugins: [revokingPlugin(revoked)] as const,
+  }).pipe(Effect.tap((executor) => executor.demo.seed()));
 const REF = {
   owner: "org",

packages/core/sdk/src/plugin-storage.test.ts+9−0

   type PluginStorageCollectionWhere,
 } from "./plugin-storage";
 import { makeTestConfig, makeTestExecutor } from "./testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const ToolCall = Schema.Struct({
   runId: Schema.String,
   it.effect("queries declared indexes through the executor's SQLite FumaDB target", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
   it.effect("bulk puts and removes plugin storage rows", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
   it.effect("stores and overwrites every row when a bulk write spans multiple batches", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
   it.effect("rolls back every plugin storage row when a bulk write fails", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
   it.effect("leaves pre-existing rows intact when a bulk overwrite fails mid-batch", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
     () =>
       Effect.gen(function* () {
         const executor = yield* makeTestExecutor({
+          access: testAccess.member(),
           backend: "sqlite",
           plugins: [executionHistoryPlugin] as const,
         });
       // One executor bound to a subject sees both org and user owner rows; a
       // user-owned row shadows an org-owned row under the same key on read.
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });
   it.effect("rejects runtime queries against undeclared index fields", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         backend: "sqlite",
         plugins: [executionHistoryPlugin] as const,
       });

packages/core/sdk/src/plugin.ts+3−3

@@ -168,9 +168,9 @@ export interface PluginCtx<TStore = unknown> { · 167 unmodified lines
168	* external work or writes to storage outside the catalog transaction. */	168	* external work or writes to storage outside the catalog transaction. */
169	readonly authorizeWrite: () => Effect.Effect<void, OrgWriteDeniedError>;	169	readonly authorizeWrite: () => Effect.Effect<void, OrgWriteDeniedError>;
170	/** Register / replace this plugin's integration in the catalog. Both	170	/** Register / replace this plugin's integration in the catalog. Both
171	* operations are workspace-level changes gated by the executor's	171	* operations are workspace-level changes gated by the product's
172	* `orgWrites` binding for end-user principals. Subjectless system	172	* `ExecutorAccess.settingsWrite` decision, including replacement by
173	* executors may re-register an existing row during boot convergence. */	173	* subjectless system executors during boot convergence. */
174	readonly register: (	174	readonly register: (
175	input: RegisterIntegrationInput,	175	input: RegisterIntegrationInput,
176	) => Effect.Effect<void, OrgWriteDeniedError \| StorageFailure>;	176	) => Effect.Effect<void, OrgWriteDeniedError \| StorageFailure>;

packages/core/sdk/src/policies.test.ts+12−8

 import { ElicitationResponse, type ElicitationHandler } from "./elicitation";
 import { createExecutor } from "./executor";
 import type { FumaDb } from "./fuma-runtime";
-import {
+// Resolution semantics are PRODUCT rules — these tests exercise the real
-  effectivePolicyFromSorted,
+// implementations from @executor-js/product-access (via the workspace root
-  isValidPattern,
+// devDependency), never a copy.
-  matchPattern,
+import { effectivePolicyFromSorted, resolveToolPolicy } from "@executor-js/product-access/policy";
-  resolveToolPolicy,
+import { isValidPattern, matchPattern } from "./policies";
-} from "./policies";
 import { definePlugin, tool } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import { makeTestConfig, makeTestExecutor } from "./testing";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Pure unit tests — pattern matcher + resolution. No executor required.
   ToolAddress.make(`tools.${integration}.org.${CONN}.${tool}`);
 const setupExecutor = () =>
-  makeTestExecutor({ plugins: [policyTestPlugin()] as const }).pipe(
+  makeTestExecutor({ access: testAccess.member(), plugins: [policyTestPlugin()] as const }).pipe(
     Effect.tap((executor) =>
       Effect.gen(function* () {
         yield* executor.ptest.seed();
   it.effect("fails when the policy vanishes during update", () =>
     Effect.gen(function* () {
       let armed = false;
-      const config = makeTestConfig({ plugins: [policyTestPlugin()] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [policyTestPlugin()] as const,
+      });
       const executor = yield* createExecutor({
         ...config,
         db: removePolicyAfterUpdate(config.db, () => armed),
   it.effect("uses provider rules as an allowlist for list, schema, and execute", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [staticPlugin, policyProviderPlugin] as const,
       });

packages/core/sdk/src/policies.ts+15−112

@@ -1,15 +1,17 @@
1	// ---------------------------------------------------------------------------	1	// ---------------------------------------------------------------------------
2	// Tool policies — pattern matcher + policy resolution. Pure functions; the	2	// Tool policies — the decision VOCABULARY (types, schemas, projections) plus
3	// executor stitches them into `tools.list`, `execute`, and the public	3	// the pure pattern-matching and rule-placement utilities the executor's CRUD
4	// `executor.policies` CRUD surface. Plugins consume the same surface.	4	// surface needs. Policies are owner-scoped (org \| user) rows.
5	//	5	//
6	// v2: policies are owner-scoped (org \| user) instead of scope-stacked. Each	6	// HOW rules resolve into an effective decision — owner ranking, the
7	// owner contributes its first matching rule by local position; the final answer	7	// most-restrictive merge across owners, the plugin-default fallback and the
8	// is the most restrictive matched action across owners, so a user preference	8	// capability-allowlist default — is a PRODUCT rule: it lives in
9	// cannot weaken an org guardrail (org = outer, user = inner).	9	// `@executor-js/product-access/policy` and reaches core only through the
		10	// `ExecutorAccess.toolPolicy` hook, whose `EffectivePolicy` answers core
		11	// enforces at list/schema/invoke/approval-recheck.
10	// ---------------------------------------------------------------------------	12	// ---------------------------------------------------------------------------
11		13
12	import { Match, Schema } from "effect";	14	import { Schema } from "effect";
13	import { generateKeyBetween } from "fractional-indexing";	15	import { generateKeyBetween } from "fractional-indexing";
14		16
15	import type { ToolPolicyAction, ToolPolicyRow } from "./core-schema";	17	import type { ToolPolicyAction, ToolPolicyRow } from "./core-schema";
@@ -121,10 +123,11 @@ export const isValidPattern = (pattern: string): boolean => { · 105 unmodified lines
121	};	123	};
122		124
123	// ---------------------------------------------------------------------------	125	// ---------------------------------------------------------------------------
124	// Resolution — each owner contributes its first matching rule by local	126	// Ordering / placement utilities. HOW matched rules combine into an
125	// position; the most restrictive matched action across owners wins. Caller	127	// effective decision (owner ranking, most-restrictive merge, fallbacks) is a
126	// passes an `ownerRank` so the resolver doesn't need to know which owner is	128	// PRODUCT rule and lives in `@executor-js/product-access/policy`; core only
127	// the outer guardrail.	129	// consumes the resulting `EffectivePolicy` through
		130	// `ExecutorAccess.toolPolicy` and enforces it.
128	// ---------------------------------------------------------------------------	131	// ---------------------------------------------------------------------------
129		132
130	export const comparePolicyRow = (	133	export const comparePolicyRow = (
@@ -180,106 +183,6 @@ export const positionForNewPattern = ( · 49 unmodified lines
180	return generateKeyBetween(prev, next);	183	return generateKeyBetween(prev, next);
181	};	184	};
182		185
183	const actionRestrictionRank = (action: ToolPolicyAction): number =>
184	Match.value(action).pipe(
185	Match.when("block", () => 3),
186	Match.when("require_approval", () => 2),
187	Match.when("approve", () => 1),
188	Match.exhaustive,
189	);
190
191	const moreRestrictive = <T extends { readonly action: ToolPolicyAction }>(
192	current: T \| undefined,
193	candidate: T,
194	): T => {
195	if (!current) return candidate;
196	const currentRank = actionRestrictionRank(current.action);
197	const candidateRank = actionRestrictionRank(candidate.action);
198	return candidateRank > currentRank ? candidate : current;
199	};
200
201	export const resolveToolPolicy = (
202	toolId: string,
203	policies: readonly ToolPolicyRow[],
204	ownerRank: (row: Pick<ToolPolicyRow, "owner">) => number,
205	): PolicyMatch \| undefined => {
206	if (policies.length === 0) return undefined;
207	const sorted = [...policies].sort((a, b) => {
208	const sa = ownerRank(a);
209	const sb = ownerRank(b);
210	if (sa !== sb) return sa - sb;
211	return comparePolicyRow(a, b);
212	});
213	const firstMatchByOwner = new Map<string, PolicyMatch>();
214	for (const row of sorted) {
215	if (firstMatchByOwner.has(row.owner)) continue;
216	if (matchPattern(row.pattern, toolId)) {
217	firstMatchByOwner.set(row.owner, {
218	action: row.action as ToolPolicyAction,
219	pattern: row.pattern,
220	policyId: row.id,
221	});
222	}
223	}
224	let selected: PolicyMatch \| undefined;
225	for (const match of firstMatchByOwner.values()) {
226	selected = moreRestrictive(selected, match);
227	}
228	return selected;
229	};
230
231	// ---------------------------------------------------------------------------
232	// Layered resolution — user-authored rules + plugin default `requiresApproval`.
233	// ---------------------------------------------------------------------------
234
235	const liftPlugin = (defaultRequiresApproval: boolean \| undefined): EffectivePolicy =>
236	defaultRequiresApproval
237	? { action: "require_approval", source: "plugin-default" }
238	: { action: "approve", source: "plugin-default" };
239
240	const liftUser = (match: PolicyMatch): EffectivePolicy => ({
241	action: match.action,
242	source: "user",
243	pattern: match.pattern,
244	policyId: match.policyId,
245	});
246
247	export const resolveEffectivePolicy = (
248	toolId: string,
249	policies: readonly ToolPolicyRow[],
250	ownerRank: (row: Pick<ToolPolicyRow, "owner">) => number,
251	defaultRequiresApproval?: boolean,
252	): EffectivePolicy => {
253	const match = resolveToolPolicy(toolId, policies, ownerRank);
254	return match ? liftUser(match) : liftPlugin(defaultRequiresApproval);
255	};
256
257	export const effectivePolicyFromSorted = (
258	toolId: string,
259	sortedPolicies: readonly (Pick<ToolPolicy, "pattern" \| "action" \| "id"> &
260	Partial<Pick<ToolPolicy, "owner">>)[],
261	defaultRequiresApproval?: boolean,
262	): EffectivePolicy => {
263	const firstMatchByOwner = new Map<string, EffectivePolicy>();
264	for (const p of sortedPolicies) {
265	const ownerKey = "owner" in p && p.owner ? String(p.owner) : "__flat__";
266	if (firstMatchByOwner.has(ownerKey)) continue;
267	if (matchPattern(p.pattern, toolId)) {
268	firstMatchByOwner.set(ownerKey, {
269	action: p.action,
270	source: "user",
271	pattern: p.pattern,
272	policyId: p.id,
273	});
274	}
275	}
276	let selected: EffectivePolicy \| undefined;
277	for (const match of firstMatchByOwner.values()) {
278	selected = moreRestrictive(selected, match);
279	}
280	return selected ?? liftPlugin(defaultRequiresApproval);
281	};
282
283	// ---------------------------------------------------------------------------	186	// ---------------------------------------------------------------------------
284	// Row → public projection.	187	// Row → public projection.
285	// ---------------------------------------------------------------------------	188	// ---------------------------------------------------------------------------

packages/core/sdk/src/promise-executor.ts+11−0

   type InvokeOptions as EffectInvokeOptions,
   type OnElicitation,
 } from "./executor";
+import type { ExecutorAccess } from "./access";
 import type { ElicitationContext, ElicitationResponse } from "./elicitation";
 import type { FumaDb, FumaTables } from "./fuma-runtime";
 import { Subject, Tenant } from "./ids";
    * an options arg.
    */
   readonly onElicitation: PromiseOnElicitation;
+  /**
+   * Product access decisions for the binding — REQUIRED, exactly as on the
+   * Effect SDK's `ExecutorConfig.access`. This façade is core SDK, not a
+   * product: it supplies no posture of its own. Embedders state theirs
+   * explicitly — `@executor-js/product-access` ships the standard ones
+   * (`singleUserAccess()` for a subject-bound single owner,
+   * `workspaceServiceAccess()` for a subject-less workspace binding).
+   */
+  readonly access: ExecutorAccess;
 }
 // ---------------------------------------------------------------------------
     plugins,
     ...(config.providers ? { providers: config.providers } : {}),
     onElicitation: toEffectOnElicitation(config.onElicitation),
+    access: config.access,
     ...(db ? { db } : {}),
   };

packages/core/sdk/src/promise.test.ts+5−0

 import type { ToolDef } from "./tool";
 import { IntegrationSlug, ToolName } from "./ids";
 import { Effect, Schema } from "effect";
+import { testAccess } from "@executor-js/product-access/testing";
 // A minimal static-tool plugin built on the Effect surface, consumed
 // through the Promise façade. Exercises the proxy's ability to promisify
   it("returns Promise-shaped executor and invokes static tools", async () => {
     const plugins = [echoPlugin()] as const;
     const executor = await createExecutor({
+      access: testAccess.org(),
       plugins,
       onElicitation: "accept-all",
     });
   it("promisifies plugin extension methods", async () => {
     const plugins = [echoPlugin()] as const;
     const executor = await createExecutor({
+      access: testAccess.org(),
       plugins,
       onElicitation: "accept-all",
     });
     const plugins = [approvedPlugin()] as const;
     const executor = await createExecutor({
+      access: testAccess.org(),
       plugins,
       onElicitation: "accept-all", // default → auto-approve
     });
     const plugins = [inventoryPlugin()] as const;
     const executor = await createExecutor({
+      access: testAccess.org(),
       plugins,
       providers: [memoryProvider],
       onElicitation: "accept-all",

packages/core/sdk/src/provider-call-timeout.test.ts+10−3

 import { definePlugin } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import { makeTestConfig } from "./test-config";
+import { testAccess } from "@executor-js/product-access/testing";
 const STORE = ProviderKey.make("remote-store");
 const INTEG = IntegrationSlug.make("acme");
 const executorWithConnection = (provider: CredentialProvider) =>
   Effect.gen(function* () {
     const executor = yield* createExecutor(
-      makeTestConfig({ plugins: [plugin(provider)] as const }),
+      makeTestConfig({ access: testAccess.member(), plugins: [plugin(provider)] as const }),
     );
     yield* executor.acme.seed();
     yield* executor.connections.create({
         get: (id) => Effect.sync(() => items.get(String(id)) ?? null),
         set: (id, value) => Effect.sync(() => void items.set(String(id), value)),
       };
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [plugin(lit)] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [plugin(lit)] as const }),
+      );
       yield* executor.acme.seed();
       yield* executor.connections.create({
         owner: "org",
       }
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [plugin(new ClassProvider() as CredentialProvider)] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [plugin(new ClassProvider() as CredentialProvider)] as const,
+        }),
       );
       yield* executor.acme.seed();
       yield* executor.connections.create({
       const executor = yield* createExecutor(
         makeTestConfig({
+          access: testAccess.member(),
           plugins: [plugin(new PrototypeProvider() as CredentialProvider)] as const,
         }),
       );

packages/core/sdk/src/settings-authority.test.ts+118−0

@@ -0,0 +1,118 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { Effect, Result } from "effect";
	3	import { testAccess } from "@executor-js/product-access/testing";
	4
	5	import type { ExecutorAccess } from "./access";
	6	import { createExecutor } from "./executor";
	7	import { IntegrationSlug, Subject } from "./ids";
	8	import { definePlugin } from "./plugin";
	9	import { makeTestConfig } from "./testing";
	10
	11	// ---------------------------------------------------------------------------
	12	// `ExecutorAccess.settingsWrite` is the product's decision, and core enforces
	13	// it VERBATIM at every user-intent settings sink — including catalog
	14	// replacement from a SUBJECT-LESS executor. A host that hands a subject-less
	15	// binding a denying `settingsWrite` has stated its rule; core must not keep a
	16	// residual rule of its own ("subject-less replacement of an existing row is
	17	// always boot convergence") that overrides the supplied denial. Products that
	18	// WANT boot convergence say so through their access implementation
	19	// (`workspaceServiceAccess`), which these tests also pin.
	20	//
	21	// The fixtures build executors over ONE test database: a workspace-service
	22	// seeder that registers the catalog row, then differently-postured executors
	23	// that attempt to replace it through the same plugin-extension path.
	24	// ---------------------------------------------------------------------------
	25
	26	const SLUG = IntegrationSlug.make("settings-authority");
	27	const SEEDED_DESCRIPTION = "seeded by the workspace service";
	28	const REPLACED_DESCRIPTION = "replaced despite a denied settings decision";
	29
	30	const catalogPlugin = definePlugin(() => ({
	31	id: "settings-authority-demo" as const,
	32	storage: () => ({}),
	33	extension: (ctx) => ({
	34	register: (description: string) =>
	35	ctx.core.integrations.register({ slug: SLUG, description, config: {} }),
	36	}),
	37	}))();
	38
	39	/** The workspace-service posture with the product's settings decision
	40	* replaced by an unconditional denial — the host's explicit word. */
	41	const denyingServiceAccess = (): ExecutorAccess => ({
	42	...testAccess.org(),
	43	settingsWrite: () => Effect.succeed("denied" as const),
	44	});
	45
	46	const setup = () =>
	47	Effect.gen(function* () {
	48	const config = makeTestConfig({
	49	subject: null,
	50	access: testAccess.org(),
	51	plugins: [catalogPlugin] as const,
	52	});
	53	const seeder = yield* createExecutor(config);
	54	yield* Effect.addFinalizer(() =>
	55	seeder
	56	.close()
	57	.pipe(
	58	Effect.ignore,
	59	Effect.andThen(Effect.promise(() => config.testDb.close()).pipe(Effect.ignore)),
	60	),
	61	);
	62	yield* seeder["settings-authority-demo"].register(SEEDED_DESCRIPTION);
	63	return { config, seeder };
	64	});
	65
	66	describe("settingsWrite authority over catalog replacement", () => {
	67	it.effect("a supplied denial refuses replacement from a subject-less executor", () =>
	68	Effect.gen(function* () {
	69	const { config, seeder } = yield* setup();
	70	const denied = yield* createExecutor({ ...config, access: denyingServiceAccess() });
	71	yield* Effect.addFinalizer(() => denied.close().pipe(Effect.ignore));
	72
	73	const outcome = yield* Effect.result(
	74	denied["settings-authority-demo"].register(REPLACED_DESCRIPTION),
	75	);
	76	// The product said "denied"; core must enforce it even with no bound
	77	// subject — there is no core-owned boot-convergence exemption.
	78	expect(Result.isFailure(outcome)).toBe(true);
	79	expect(outcome).toMatchObject({ failure: { _tag: "OrgWriteDeniedError" } });
	80
	81	const after = yield* seeder.integrations.get(SLUG);
	82	expect(after?.description).toBe(SEEDED_DESCRIPTION);
	83	}).pipe(Effect.scoped),
	84	);
	85
	86	it.effect("boot convergence stays available when the product allows it", () =>
	87	Effect.gen(function* () {
	88	const { seeder } = yield* setup();
	89	// The same subject-less posture with the product's own (allowing)
	90	// decision converges the existing row — the rule lives in the product,
	91	// not in core.
	92	yield* seeder["settings-authority-demo"].register("converged at boot");
	93	const after = yield* seeder.integrations.get(SLUG);
	94	expect(after?.description).toBe("converged at boot");
	95	}).pipe(Effect.scoped),
	96	);
	97
	98	it.effect("baseline: a bound member's denial already refuses replacement", () =>
	99	Effect.gen(function* () {
	100	const { config, seeder } = yield* setup();
	101	const member = yield* createExecutor({
	102	...config,
	103	subject: Subject.make("member-1"),
	104	access: testAccess.member("denied"),
	105	});
	106	yield* Effect.addFinalizer(() => member.close().pipe(Effect.ignore));
	107
	108	const outcome = yield* Effect.result(
	109	member["settings-authority-demo"].register(REPLACED_DESCRIPTION),
	110	);
	111	expect(Result.isFailure(outcome)).toBe(true);
	112	expect(outcome).toMatchObject({ failure: { _tag: "OrgWriteDeniedError" } });
	113
	114	const after = yield* seeder.integrations.get(SLUG);
	115	expect(after?.description).toBe(SEEDED_DESCRIPTION);
	116	}).pipe(Effect.scoped),
	117	);
	118	});

packages/core/sdk/src/shared.ts+2−1

 } from "./elicitation";
 // Tool-policy helpers + projections (pure functions / Schema).
+// Resolution semantics (owner ranking, most-restrictive merge, fallbacks)
+// live in `@executor-js/product-access/policy`, which builds on these.
 export {
   matchPattern,
   isValidPattern,
-  effectivePolicyFromSorted,
   comparePolicyRow,
   patternSpecificity,
   positionForNewPattern,

packages/core/sdk/src/sqlite-bigint-storage-class-migration.test.ts+20−4

         });
         expect(await storageClassOf(db, "c_legacy")).toBe("integer");
-        const scoped = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT });
+        const scoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT,
+          owners: ["user", "org"],
+        });
         // Not "returns a bad value" — the read THROWS, which is why the gateway
         // lost every saved integration rather than one field of one row.
         await expect(scoped.findMany("connection", {})).rejects.toThrow(/type number/);
         expect(await storageClassOf(db, "c_healthy")).toBe("blob");
         expect(await storageClassOf(db, "c_null")).toBe("null");
-        const scoped = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT });
+        const scoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT,
+          owners: ["user", "org"],
+        });
         const rows = await scoped.findMany("connection", {});
         expect(
           rows.map((row) => [row.name, row.expires_at == null ? null : Number(row.expires_at)]),
         expect(await Effect.runPromise(runSqliteBigintStorageClassMigration(db.client))).toBe(1);
         expect(await Effect.runPromise(runSqliteBigintStorageClassMigration(db.client))).toBe(0);
-        const scoped = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT });
+        const scoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT,
+          owners: ["user", "org"],
+        });
         const rows = await scoped.findMany("connection", {});
         expect(rows.map((row) => Number(row.expires_at))).toEqual([LEGACY_EXPIRES_AT]);
       }),
         expect(await Effect.runPromise(runSqliteBigintStorageClassMigration(db.client))).toBe(2);
-        const scoped = withQueryContext(db.db, { tenant: TENANT, subject: SUBJECT });
+        const scoped = withQueryContext(db.db, {
+          tenant: TENANT,
+          subject: SUBJECT,
+          owners: ["user", "org"],
+        });
         const integrations = await scoped.findMany("integration", {});
         expect(integrations.map((row) => Number(row.config_revised_at))).toEqual([
           LEGACY_EXPIRES_AT,

packages/core/sdk/src/subject-registry.test.ts+6−0

 import { createSqliteTestFumaDb, type SqliteTestFumaDb } from "./sqlite-test-db";
 import { resetSubjectTouchCache, touchSubject } from "./subject-registry";
 import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
+import { testAccess } from "@executor-js/product-access/testing";
 // `touchSubject` is the only writer of the `subject` table. Written against the
 // real SQLite bring-up (the same statements local/self-host/D1 boot with) so
   withQueryContext(db.db, {
     tenant,
     subject: null,
+    owners: [],
   } satisfies ExecutorOwnerPolicyContext);
 const storedSubjects = (
     const rows = await withQueryContext(harness.config.db as never, {
       tenant,
       subject: null,
+      owners: [],
     } satisfies ExecutorOwnerPolicyContext).findMany("subject", {});
     return rows.map((row) => String(row.external_id));
   });
     Effect.scoped(
       Effect.gen(function* () {
         const harness = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant: TENANT,
         });
         // The row names the acting principal, not the connection's owner tier:
         // a member who only ever creates org connections still exists.
         const harness = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant: TENANT,
         });
     Effect.scoped(
       Effect.gen(function* () {
         const harness = yield* makeTestWorkspaceHarness({
+          access: testAccess.org(),
           plugins,
           tenant: TENANT,
           subject: null,

packages/core/sdk/src/subject-registry.ts+3−0

       withQueryContext(db, {
         tenant: input.tenant,
         subject: externalId,
+        // This host-internal writer touches ONLY the tenant-scoped `subject`
+        // table; it holds no owner-scoped view at all, stated explicitly.
+        owners: [],
       } satisfies ExecutorOwnerPolicyContext),
     );
     // No `tenant` clause: the tenant policy adds it to every read/update.

packages/core/sdk/src/test-config.ts+18−9

 import { Context, Effect, Layer } from "effect";
 import { withQueryContext } from "@executor-js/fumadb/query";
+import type { ExecutorAccess } from "./access";
 import { collectTables, createExecutor, type Executor, type ExecutorConfig } from "./executor";
 import type { FumaDb } from "./fuma-runtime";
 import { ProviderItemId, ProviderKey, Subject, Tenant } from "./ids";
   readonly onIntegrationChange?: ExecutorConfig<TPlugins>["onIntegrationChange"];
   readonly firstPartyOAuthClients?: ExecutorConfig<TPlugins>["firstPartyOAuthClients"];
   readonly enterpriseManagedRollout?: ExecutorConfig<TPlugins>["enterpriseManagedRollout"];
-  /** Workspace-settings permission for the test binding (see
+  /** Product access decisions for the test binding (see
-   *  `ExecutorConfig.orgWrites`). Defaults to allowed, like production hosts
+   *  `ExecutorConfig.access`). REQUIRED — this fixture is generic and has no
-   *  with no role model. */
+   *  posture of its own. Tests state one explicitly, normally from
-  readonly orgWrites?: ExecutorConfig<TPlugins>["orgWrites"];
+   *  `@executor-js/product-access/testing` (`testAccess.member()`, …; the
+   *  sdk's own tests resolve that package through the workspace ROOT
+   *  devDependency, keeping the package graph acyclic). */
+  readonly access: ExecutorAccess;
   readonly waitUntil?: ExecutorConfig<TPlugins>["waitUntil"];
 };
 export const makeTestConfig = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
-  options?: TestConfigOptions<TPlugins>,
+  options: TestConfigOptions<TPlugins>,
 ): Omit<ExecutorConfig<TPlugins>, "db"> & {
   readonly db: FumaDb;
   readonly testDb: TestFumaDb;
     backend: options?.backend ?? "sqlite",
     dataDir: options?.dataDir,
   });
+  // The fixture's SEEDING/INSPECTION handle: tests read and write rows
+  // through it directly, so it carries the binding's full identity view,
+  // stated explicitly. The executor built from this config re-binds its own
+  // context from `options.access` and never inherits this one.
   const db = withQueryContext(testDb.db, {
     tenant,
     subject,
+    owners: subject != null ? ["user", "org"] : ["org"],
   } satisfies ExecutorOwnerPolicyContext);
   // EXPLICIT OAuth callback: default to a stable test URL so the redirect flow
     onElicitation: "accept-all",
     onIntegrationChange: options?.onIntegrationChange,
     ...(redirectUri != null ? { redirectUri } : {}),
-    ...(options?.orgWrites === undefined ? {} : { orgWrites: options.orgWrites }),
+    access: options.access,
     oauthCallbackStateOrgSlug: options?.oauthCallbackStateOrgSlug,
     firstPartyOAuthClients: options?.firstPartyOAuthClients,
     enterpriseManagedRollout: options?.enterpriseManagedRollout,
 }
 export const makeTestWorkspaceHarness = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
-  options?: TestConfigOptions<TPlugins>,
+  options: TestConfigOptions<TPlugins>,
 ) =>
   Effect.acquireRelease(
     Effect.gen(function* () {
   );
 export const makeTestWorkspaceLayer = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
-  options?: TestConfigOptions<TPlugins>,
+  options: TestConfigOptions<TPlugins>,
 ) =>
   Layer.effect(TestWorkspace)(
     makeTestWorkspaceHarness(options).pipe(
   );
 export const makeTestExecutor = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
-  options?: TestConfigOptions<TPlugins>,
+  options: TestConfigOptions<TPlugins>,
 ) => makeTestWorkspaceHarness(options).pipe(Effect.map(({ executor }) => executor));
 /** Built-in in-memory writable credential provider, contributed as a plugin

packages/core/sdk/src/testing.test.ts+5−1

   OAuthTestServer,
   TestWorkspace,
 } from "./testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const plugins = [memoryCredentialsPlugin()] as const;
-const TestLayer = Layer.mergeAll(makeTestWorkspaceLayer({ plugins }), OAuthTestServer.layer());
+const TestLayer = Layer.mergeAll(
+  makeTestWorkspaceLayer({ access: testAccess.member(), plugins }),
+  OAuthTestServer.layer(),
+);
 layer(TestLayer, { timeout: "15 seconds" })("testing fixtures", (it) => {
   it.effect("TestWorkspace exposes the real executor bound to tenant/subject", () =>

packages/core/sdk/src/tool-not-found-empty-catalog.test.ts+4−1

 import { definePlugin } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import { makeTestConfig } from "./test-config";
+import { testAccess } from "@executor-js/product-access/testing";
 const STORE = ProviderKey.make("memory");
 const INTEG = IntegrationSlug.make("demo");
 const failInvoking = (plugin: ReturnType<typeof pluginWith>, tool: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor({ ...makeTestConfig({ plugins: [plugin] as const }) });
+    const executor = yield* createExecutor({
+      ...makeTestConfig({ access: testAccess.member(), plugins: [plugin] as const }),
+    });
     yield* executor.demo.seed();
     yield* executor.connections.create({
       owner: "org",

packages/core/sdk/src/tools-list-merge.test.ts+5−3

 import { AuthTemplateSlug, ConnectionName, IntegrationSlug, ToolName } from "./ids";
 import { definePlugin } from "./plugin";
 import { makeTestExecutor, memoryCredentialsPlugin } from "./testing";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Cross-owner merge regression (the "Axiom shows 0 tools" bug).
 // Default test executor binds `subject: "test-subject"`, so user-owned
 // connections/tools can be created and merge with org rows.
 const setup = () =>
-  makeTestExecutor({ plugins: [memoryCredentialsPlugin(), demoPlugin] as const }).pipe(
+  makeTestExecutor({
-    Effect.tap((executor) => executor.demo.seed()),
+    access: testAccess.member(),
-  );
+    plugins: [memoryCredentialsPlugin(), demoPlugin] as const,
+  }).pipe(Effect.tap((executor) => executor.demo.seed()));
 describe("tools.list cross-owner merge", () => {
   it.effect("lists user-owned tools when owner is omitted (the fix)", () =>

packages/hosts/cloudflare/src/blob-store.test.ts+4−1

     Effect.gen(function* () {
       const { bucket } = makeFakeBucket();
       const store = makeR2BlobStore(bucket);
-      const plugin = pluginBlobStore(store, { org: "o:t1", user: "u:t1:s1" }, "openapi");
+      const plugin = pluginBlobStore(store, { org: "o:t1", user: "u:t1:s1" }, "openapi", {
+        owners: ["user", "org"],
+        storageWrites: "allowed",
+      });
       yield* plugin.put("spec/h1", "org-spec", { owner: "org" });
       expect(yield* plugin.get("spec/h1")).toBe("org-spec");

packages/hosts/mcp-apps-shell/package.json+1−0

@@ -79,6 +79,7 @@ · 78 unmodified lines
79	"@effect/vitest": "catalog:",	79	"@effect/vitest": "catalog:",
80	"@executor-js/execution": "workspace:*",	80	"@executor-js/execution": "workspace:*",
81	"@executor-js/host-mcp": "workspace:*",	81	"@executor-js/host-mcp": "workspace:*",
		82	"@executor-js/product-access": "workspace:*",
82	"@executor-js/sdk": "workspace:*",	83	"@executor-js/sdk": "workspace:*",
83	"@tailwindcss/browser": "^4.2.2",	84	"@tailwindcss/browser": "^4.2.2",
84	"@tailwindcss/vite": "catalog:",	85	"@tailwindcss/vite": "catalog:",

packages/hosts/mcp-apps-shell/src/shell/mcp-app.browser.test.ts+5−1

 import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server";
 import { loadMcpAppsShellHtml } from "../shell-html";
+import { testAccess } from "@executor-js/product-access/testing";
 type ShellServer = {
   readonly url: string;
   const executor = await Effect.runPromise(
     Effect.gen(function* () {
       const built = yield* createExecutor(
-        makeTestConfig({ plugins: [inventoryPlugin(openApi.postRequests)] }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [inventoryPlugin(openApi.postRequests)],
+        }),
       );
       // Tools only exist per connection, so register the integration and open
       // one org `main` connection — that is what makes

packages/hosts/mcp/package.json+1−0

@@ -46,6 +46,7 @@ · 45 unmodified lines
46	"dependencies": {	46	"dependencies": {
47	"@cfworker/json-schema": "^4.1.1",	47	"@cfworker/json-schema": "^4.1.1",
48	"@executor-js/execution": "workspace:*",	48	"@executor-js/execution": "workspace:*",
		49	"@executor-js/product-access": "workspace:*",
49	"@executor-js/sdk": "workspace:*",	50	"@executor-js/sdk": "workspace:*",
50	"@modelcontextprotocol/ext-apps": "^1.7.4",	51	"@modelcontextprotocol/ext-apps": "^1.7.4",
51	"@modelcontextprotocol/sdk": "^1.29.0",	52	"@modelcontextprotocol/sdk": "^1.29.0",

packages/hosts/mcp/src/in-memory-session-store.test.ts+19−5

 } from "./in-memory-session-store";
 import { defaultMcpResource, type Principal } from "./seams";
 import { createExecutorMcpServer } from "./tool-server";
+import { testAccess } from "@executor-js/product-access/testing";
 const TEST_PRINCIPAL: Principal = {
   accountId: "acct_test",
 it("keeps overlapping warm-session workspace writes bound to their request roles", async () => {
   const executor = await Effect.runPromise(
-    createExecutor({ ...makeTestConfig(), orgWrites: "request" }),
+    createExecutor({
+      ...makeTestConfig({ access: testAccess.member() }),
+      access: testAccess.requestBound(),
+    }),
   );
   const started = new Map<string, () => void>();
   const startedPromises = ["member", "admin"].map(
 it("binds a paused workspace write to the resuming principal after demotion", async () => {
   const executor = await Effect.runPromise(
-    createExecutor({ ...makeTestConfig(), orgWrites: "request" }),
+    createExecutor({
+      ...makeTestConfig({ access: testAccess.member() }),
+      access: testAccess.requestBound(),
+    }),
   );
   const executionId = "exec_resume_demotion";
   const pattern = "paused-resume-demotion.*";
 it("uses the browser approver's demoted role after an admin starts waiting", async () => {
   const executor = await Effect.runPromise(
-    createExecutor({ ...makeTestConfig({ coreTools: {} }), orgWrites: "request" }),
+    createExecutor({
+      ...makeTestConfig({ access: testAccess.member(), coreTools: {} }),
+      access: testAccess.requestBound(),
+    }),
   );
   const executionId = "exec_browser_resume_demotion";
   const pattern = "browser-resume-demotion.*";
   it("shuts down the scoped executor and custom closer when an idle session is evicted", async () => {
     let executorClosed = 0;
     let customClosed = 0;
-    const realExecutor = await Effect.runPromise(createExecutor(makeTestConfig()));
+    const realExecutor = await Effect.runPromise(
+      createExecutor(makeTestConfig({ access: testAccess.member() })),
+    );
     const testExecutor = {
       ...realExecutor,
       close: () =>
   it("shuts down the scoped executor when sessions.close() is called", async () => {
     let executorClosed = 0;
-    const realExecutor = await Effect.runPromise(createExecutor(makeTestConfig()));
+    const realExecutor = await Effect.runPromise(
+      createExecutor(makeTestConfig({ access: testAccess.member() })),
+    );
     const testExecutor = {
       ...realExecutor,
       close: () =>

packages/hosts/mcp/src/seams.ts+5−2

 import { Context, Effect, Layer, Schema } from "effect";
 import type { Cause } from "effect";
+import { orgWriteAccessForRole } from "@executor-js/product-access";
 import type { OrgWriteAccess } from "@executor-js/sdk";
 // ---------------------------------------------------------------------------
 /** Internal header overwritten by a trusted session store before MCP dispatch. */
 export const MCP_ORG_WRITE_ACCESS_HEADER = "x-executor-org-write-access";
-/** Derive the effective workspace-write access for one authenticated request. */
+/** Derive the effective workspace-write access for one authenticated request
+ *  — the product's role rule (`@executor-js/product-access`), applied here at
+ *  the serving boundary that stamps the request-bound carrier. */
 export const orgWriteAccessForPrincipal = (principal: Principal): OrgWriteAccess =>
-  principal.orgRoleModel === "none" || principal.orgRole === "admin" ? "allowed" : "denied";
+  orgWriteAccessForRole(principal);
 /**
  * Stamp request-bound workspace-write access for the MCP SDK request handler.

packages/kernel/runtime-dynamic-worker/package.json+1−0

@@ -25,6 +25,7 @@ · 24 unmodified lines
25	"@executor-js/execution": "workspace:*",	25	"@executor-js/execution": "workspace:*",
26	"@executor-js/fumadb": "workspace:*",	26	"@executor-js/fumadb": "workspace:*",
27	"@executor-js/plugin-openapi": "workspace:*",	27	"@executor-js/plugin-openapi": "workspace:*",
		28	"@executor-js/product-access": "workspace:*",
28	"@executor-js/sdk": "workspace:*",	29	"@executor-js/sdk": "workspace:*",
29	"@types/node": "catalog:",	30	"@types/node": "catalog:",
30	"drizzle-orm": "catalog:",	31	"drizzle-orm": "catalog:",

packages/kernel/runtime-dynamic-worker/src/integration.test.ts+2−0

   type FumaDb,
   type FumaTables,
 } from "@executor-js/sdk";
+import { testAccess } from "@executor-js/product-access/testing";
 import { makeExecutorToolInvoker } from "@executor-js/execution";
 import { openApiPlugin, variable, type AuthenticationInput } from "@executor-js/plugin-openapi";
         providers: [memoryProvider()],
         plugins,
         onElicitation: "accept-all",
+        access: testAccess.member(),
       });
       // v2: addSpec registers the integration; tools are produced per-connection,
       // so an org `main` connection is required for the operation to be callable.

packages/plugins/desktop-settings/package.json+1−0

@@ -47,6 +47,7 @@ · 46 unmodified lines
47	"react": "catalog:"	47	"react": "catalog:"
48	},	48	},
49	"devDependencies": {	49	"devDependencies": {
		50	"@executor-js/product-access": "workspace:*",
50	"@types/react": "catalog:",	51	"@types/react": "catalog:",
51	"tsup": "catalog:",	52	"tsup": "catalog:",
52	"typescript": "catalog:"	53	"typescript": "catalog:"

packages/plugins/desktop-settings/src/server.test.ts+2−0

 import { makeTestExecutor } from "@executor-js/sdk/testing";
 import { desktopSettingsPlugin } from "./server";
+import { testAccess } from "@executor-js/product-access/testing";
 describe("desktopSettingsPlugin", () => {
   it.effect("returns a browser handoff URL for Desktop-only settings", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [desktopSettingsPlugin({ webBaseUrl: "http://executor.test/base/" })] as const,
       });

packages/plugins/file-secrets/package.json+1−0

@@ -47,6 +47,7 @@ · 46 unmodified lines
47	"@executor-js/sdk": "workspace:*"	47	"@executor-js/sdk": "workspace:*"
48	},	48	},
49	"devDependencies": {	49	"devDependencies": {
		50	"@executor-js/product-access": "workspace:*",
50	"@types/node": "catalog:",	51	"@types/node": "catalog:",
51	"bun-types": "catalog:",	52	"bun-types": "catalog:",
52	"effect": "catalog:",	53	"effect": "catalog:",

packages/plugins/file-secrets/src/data-dir.test.ts+11−2

 import { makeTestWorkspaceHarness } from "@executor-js/sdk/testing";
 import { fileSecretsPlugin } from "./index";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEGRATION = IntegrationSlug.make("durable-secrets");
 const CONNECTION = ConnectionName.make("main");
       vi.stubEnv("XDG_DATA_HOME", firstSandboxDataHome);
       const firstAuthPath = yield* Effect.scoped(
         Effect.gen(function* () {
-          const first = yield* makeTestWorkspaceHarness({ dataDir, plugins: plugins() });
+          const first = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            dataDir,
+            plugins: plugins(),
+          });
           yield* first.executor.connectionFixture.registerIntegration();
           const connection = yield* first.executor.connections.create({
             owner: "org",
       vi.stubEnv("XDG_DATA_HOME", recreatedSandboxDataHome);
       yield* Effect.scoped(
         Effect.gen(function* () {
-          const recreated = yield* makeTestWorkspaceHarness({ dataDir, plugins: plugins() });
+          const recreated = yield* makeTestWorkspaceHarness({
+            access: testAccess.member(),
+            dataDir,
+            plugins: plugins(),
+          });
           const connections = yield* recreated.executor.connections.list({
             integration: INTEGRATION,
           });

packages/plugins/file-secrets/src/index.test.ts+8−1

 import { makeTestWorkspaceHarness } from "@executor-js/sdk/testing";
 import { fileSecretsPlugin } from "./index";
+import { testAccess } from "@executor-js/product-access/testing";
 const FILE_PROVIDER = ProviderKey.make("file");
 const inspectPlugin = (plugin: ReturnType<typeof fileSecretsPlugin>) =>
   Effect.scoped(
     Effect.gen(function* () {
-      const workspace = yield* makeTestWorkspaceHarness({ plugins: [plugin] as const });
+      const workspace = yield* makeTestWorkspaceHarness({
+        access: testAccess.member(),
+        plugins: [plugin] as const,
+      });
       const items = yield* workspace.executor.providers.items(FILE_PROVIDER);
       return {
         filePath: workspace.executor.fileSecrets.filePath,
         vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
         writeAuthFile(legacyFilePath, "not-json");
         const workspace = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [fileSecretsPlugin()] as const,
         });
         vi.stubEnv("EXECUTOR_DATA_DIR", dataDir);
         mkdirSync(legacyFilePath, { recursive: true });
         const workspace = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [fileSecretsPlugin()] as const,
         });
         const legacyContents = '{"legacy-token":"legacy-secret"}';
         writeAuthFile(legacyFilePath, legacyContents);
         const workspace = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins: [fileSecretsPlugin()] as const,
         });

packages/plugins/graphql/package.json+1−0

@@ -71,6 +71,7 @@ · 70 unmodified lines
71	"@effect/atom-react": "catalog:",	71	"@effect/atom-react": "catalog:",
72	"@effect/vitest": "catalog:",	72	"@effect/vitest": "catalog:",
73	"@executor-js/api": "workspace:*",	73	"@executor-js/api": "workspace:*",
		74	"@executor-js/product-access": "workspace:*",
74	"@executor-js/react": "workspace:*",	75	"@executor-js/react": "workspace:*",
75	"@types/node": "catalog:",	76	"@types/node": "catalog:",
76	"@types/react": "catalog:",	77	"@types/react": "catalog:",

packages/plugins/graphql/src/sdk/configure.test.ts+2−0

 import { graphqlPlugin } from "./plugin";
 import type { GraphqlAuthMethod } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 const makeExecutor = () =>
   createExecutor(
     makeTestConfig({
+      access: testAccess.member(),
       plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const,
     }),
   );

packages/plugins/graphql/src/sdk/invocation-timeout.test.ts+2−0

 import { makeGreetingGraphqlSchema } from "../testing";
 import { graphqlPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const INVOCATION_TIMEOUT_MS = 100;
       const server = yield* startHangingResponseServer(closed);
       const executor = yield* createExecutor(
         makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             memoryCredentialsPlugin(),
             graphqlPlugin({

packages/plugins/graphql/src/sdk/multi-placement-auth.test.ts+5−1

 import { graphqlPlugin } from "./plugin";
 import { variable } from "@executor-js/sdk/http-auth";
 import { makeGreetingGraphqlSchema, serveGraphqlTestServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const serveGreetingServer = serveGraphqlTestServer({ schema: makeGreetingGraphqlSchema() });
 const makeExecutor = () =>
   createExecutor(
-    makeTestConfig({ plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const }),
+    makeTestConfig({
+      access: testAccess.member(),
+      plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const,
+    }),
   );
 const toolAddr = (integration: string, connection: string, tool: string): ToolAddress =>

packages/plugins/graphql/src/sdk/plugin.test.ts+12−3

   serveGraphqlTestServer,
   waitForRecordedRequests,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: v1 secret browser-handoff, credential-binding scopes, usagesForSecret/
 // usagesForConnection, multi-scope shadowing, and `executor.sources.*` /
 const makeExecutor = () =>
   createExecutor(
-    makeTestConfig({ plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const }),
+    makeTestConfig({
+      access: testAccess.member(),
+      plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const,
+    }),
   );
 const recordingBlobStore = () => {
   it.effect("denies member schema persistence before writing an org blob", () =>
     Effect.gen(function* () {
       const blobs = recordingBlobStore();
-      const config = makeTestConfig({ plugins: [graphqlPlugin()] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [graphqlPlugin()] as const,
+      });
       const member = yield* createExecutor({
         ...config,
         blobs: blobs.store,
-        orgWrites: "denied",
+        access: testAccess.member("denied"),
       });
       const error = yield* member.graphql
         }),
       );
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const,
       });
       const executor = yield* createExecutor({ ...config, httpClientLayer });
   it.effect("static executor.graphql.addIntegration registers an unreachable endpoint", () =>
     Effect.gen(function* () {
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), graphqlPlugin()] as const,
       });
       const executor = yield* createExecutor(config);

packages/plugins/keychain/package.json+1−0

@@ -49,6 +49,7 @@ · 48 unmodified lines
49	},	49	},
50	"devDependencies": {	50	"devDependencies": {
51	"@effect/vitest": "catalog:",	51	"@effect/vitest": "catalog:",
		52	"@executor-js/product-access": "workspace:*",
52	"@types/node": "catalog:",	53	"@types/node": "catalog:",
53	"bun-types": "catalog:",	54	"bun-types": "catalog:",
54	"effect": "catalog:",	55	"effect": "catalog:",

packages/plugins/keychain/src/index.test.ts+4−3

 import { keychainPlugin } from "./index";
 import { makeKeychainProvider } from "./provider";
 import { setPassword, deletePassword } from "./keyring";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: v1 tests routed through `executor.secrets.set/get/remove` with
 // `ScopeId`/`SecretId`/`SetSecretInput`/`RemoveSecretInput` and a scope-derived
   it.effect("exposes keychain metadata and registers a provider when reachable", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({
+        makeTestConfig({ access: testAccess.member(), plugins: [keychainPlugin()] as const }),
-          plugins: [keychainPlugin()] as const,
-        }),
       );
       expect(executor.keychain.displayName).toBeTypeOf("string");
         const executor = yield* createExecutor(
           makeTestConfig({
+            access: testAccess.member(),
             plugins: [keychainPlugin({ serviceName })] as const,
           }),
         );
     Effect.gen(function* () {
       const executor = yield* createExecutor(
         makeTestConfig({
+          access: testAccess.member(),
           plugins: [keychainPlugin({ serviceName: "executor-test" })] as const,
         }),
       );

packages/plugins/mcp/package.json+1−0

@@ -76,6 +76,7 @@ · 75 unmodified lines
76	"@effect/atom-react": "catalog:",	76	"@effect/atom-react": "catalog:",
77	"@effect/vitest": "catalog:",	77	"@effect/vitest": "catalog:",
78	"@executor-js/api": "workspace:*",	78	"@executor-js/api": "workspace:*",
		79	"@executor-js/product-access": "workspace:*",
79	"@executor-js/react": "workspace:*",	80	"@executor-js/react": "workspace:*",
80	"@modelcontextprotocol/server": "2.0.0",	81	"@modelcontextprotocol/server": "2.0.0",
81	"@types/node": "catalog:",	82	"@types/node": "catalog:",

packages/plugins/mcp/src/sdk/catalog-sync.test.ts+9−2

 import { createMcpConnector } from "./connection";
 import { discoverTools } from "./discover";
 import { makeMutableCatalogMcpServer, serveMcpServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEG = IntegrationSlug.make("catalog_mcp");
 const CONNECTION = ConnectionName.make("main");
   },
 ) =>
   createExecutor({
-    ...makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+    ...makeTestConfig({
+      access: testAccess.member(),
+      plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+    }),
     ...(options?.toolsSyncTtlMs === undefined ? {} : { toolsSyncTtlMs: options.toolsSyncTtlMs }),
     ...(options?.toolsSyncGraceMs === undefined
       ? {}
     Effect.gen(function* () {
       const fixture = yield* serveLatchedListServer();
       const executor = yield* createExecutor({
-        ...makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        ...makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
         // Everything is expired on every read, so a single tools read has the
         // whole set to rebuild.
         toolsSyncTtlMs: 0,

packages/plugins/mcp/src/sdk/elicitation.test.ts+10−2

 import { mcpPlugin } from "./plugin";
 import { makeElicitationMcpServer, serveMcpServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const isFormElicitation = Schema.is(FormElicitation);
 const makeTestExecutor = (serverUrl: string) =>
   Effect.acquireRelease(
-    createExecutor(makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const })),
+    createExecutor(
+      makeTestConfig({
+        access: testAccess.member(),
+        plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+      }),
+    ),
     (executor) => executor.close().pipe(Effect.ignore),
   ).pipe(
     Effect.tap((executor) =>
   it.effect("addServer preserves the configured display name as the integration description", () =>
     Effect.gen(function* () {
       const server = yield* serveElicitationTestServer;
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.mcp.addServer({
         name: "Gmail",

packages/plugins/mcp/src/sdk/image-content.test.ts+5−1

   makeImageMcpServer,
   serveMcpServer,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEGRATION = IntegrationSlug.make("image_mcp");
 const TEMPLATE = AuthTemplateSlug.make("none");
     Effect.gen(function* () {
       const server = yield* serveMcpServer(makeImageMcpServer);
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       yield* executor.mcp.addServer({

packages/plugins/mcp/src/sdk/multi-placement-auth.test.ts+17−4

 import { mcpPlugin } from "./plugin";
 import { variable } from "@executor-js/sdk/http-auth";
 import { makeEchoMcpServer, serveMcpServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const serveRecordingServer = serveMcpServer(() =>
   makeEchoMcpServer({
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       yield* executor.mcp.addServer({
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       yield* executor.mcp.addServer({
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       // Two declared methods; each connection picks one by template slug.
     Effect.gen(function* () {
       const server = yield* serveRecordingServer;
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       yield* executor.mcp.addServer({

packages/plugins/mcp/src/sdk/owner-isolation.test.ts+5−1

 import { mcpPlugin } from "./plugin";
 import { makeEchoMcpServer, serveMcpServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const INTEG = IntegrationSlug.make("iso_mcp");
 const TEMPLATE = AuthTemplateSlug.make("bearer");
     Effect.gen(function* () {
       const server = yield* serveAuthRecordingMcpServer;
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       // One integration with a Bearer header auth template; the connection's

packages/plugins/mcp/src/sdk/plugin.test.ts+80−24

 import { McpInvocationError } from "./errors";
 import { extractManifestFromListToolsResult, deriveMcpNamespace, joinToolPath } from "./manifest";
 import { makeAnnotationsMcpServer, serveMcpServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: the v1 addSource / scopes / secrets / credential-binding / usages /
 // sources.configure / multi-scope shadowing suites. v2 has no scope stack, no
     Effect.gen(function* () {
       const server = yield* serveCallToolServer(input.callTool);
       const config = makeTestConfig({
+        access: testAccess.member(),
         plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
       });
       const executor = yield* createExecutor(config);
   it.effect("creates executor with mcp plugin", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
-          plugins: [mcpPlugin()] as const,
-        }),
       );
       expect(executor.mcp).toBeDefined();
   it.effect("integration catalog has no configured MCP integrations initially", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       const integrations = yield* executor.integrations.list();
       expect(integrations.filter((i) => i.kind === "mcp")).toHaveLength(0);
     }),
   it.effect("projects an MCP server family into the integration catalog", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.mcp.addServer({
         name: "Cloudflare Docs",
         family: "cloudflare",
   it.effect("connection tools list is empty until a connection is created", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       const tools = yield* executor.tools.list();
       expect(tools.filter((tool) => String(tool.address).startsWith("tools."))).toHaveLength(0);
     }),
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: [] });
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+          }),
         );
         const attachedClient = OAuthClientSlug.make("axiom-mcp");
         const unrelatedClient = OAuthClientSlug.make("manual-app");
     Effect.scoped(
       Effect.gen(function* () {
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+          }),
         );
         yield* executor.mcp.addServer({
   // adding an API key to an OAuth server must NOT displace the OAuth method.
   it.effect("configureAuth merge-appends a custom method without clobbering oauth", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.mcp.addServer({
         name: "OAuth MCP",
   it.effect("configureAuth replace mode swaps the declared set with kind-based slugs", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.mcp.addServer({
         name: "Open MCP",
           scopes: ["channels:history", "users:read"],
         });
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+          }),
         );
         yield* executor.mcp.addServer({
       Effect.gen(function* () {
         const server = yield* serveOAuthTestServer({ scopes: ["mcp"] });
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+          }),
         );
         yield* executor.mcp.addServer({
   it.effect("registers integration + connection with 0 tools when discovery fails", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+        makeTestConfig({
+          access: testAccess.member(),
+          plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+        }),
       );
       const slugStr = "broken_source";
   it.effect("static probeEndpoint returns actionable tool failures", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [mcpPlugin()] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [mcpPlugin()] as const,
+      });
       const executor = yield* createExecutor(config);
       const result = yield* executor.execute(ToolAddress.make("executor.mcp.probeEndpoint"), {
                 ),
           ),
         );
-        const config = makeTestConfig({ plugins: [mcpPlugin()] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [mcpPlugin()] as const,
+        });
         const executor = yield* createExecutor(config);
         const result = yield* executor.mcp.probeEndpoint(server.url("/mcp"));
                 : HttpServerResponse.jsonUnsafe({ message: "Unauthorized" }, { status: 401 }),
             ),
           );
-          const config = makeTestConfig({ plugins: [mcpPlugin()] as const });
+          const config = makeTestConfig({
+            access: testAccess.member(),
+            plugins: [mcpPlugin()] as const,
+          });
           const executor = yield* createExecutor(config);
           const result = yield* executor.mcp.probeEndpoint(server.url("/mcp"));
             return HttpServerResponse.jsonUnsafe({ message: "Unauthorized" }, { status: 401 });
           }),
         );
-        const config = makeTestConfig({ plugins: [mcpPlugin()] as const });
+        const config = makeTestConfig({
+          access: testAccess.member(),
+          plugins: [mcpPlugin()] as const,
+        });
         const executor = yield* createExecutor(config);
         const result = yield* executor.mcp.probeEndpoint(server.url("/mcp"));
 const seedAnnotationsExecutor = (serverUrl: string) =>
   createExecutor(
-    makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
+    makeTestConfig({
+      access: testAccess.member(),
+      plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const,
+    }),
   ).pipe(
     Effect.tap((executor) =>
       Effect.gen(function* () {
   // a candidate.
   it.effect("returns low-confidence candidate when path has /mcp segment", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       const results = yield* executor.integrations.detect("http://127.0.0.1:1/api/mcp");
       const mcp = results.find((r) => r.kind === "mcp");
       expect(mcp).toBeDefined();
   it.effect("matches mcp on hostname label", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       const results = yield* executor.integrations.detect("http://mcp.127.0.0.1.nip.io:1/");
       const mcp = results.find((r) => r.kind === "mcp");
       expect(mcp?.confidence).toBe("low");
   it.effect("does not match mcp as a substring", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       // `/mcpstore` contains `mcp` but it is not a separator-bounded run, so
       // the URL-token fallback must not fire.
       const results = yield* executor.integrations.detect("http://127.0.0.1:1/mcpstore");
   it.effect("returns null when no token match and no wire-shape match", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       const results = yield* executor.integrations.detect("http://127.0.0.1:1/api/v1");
       expect(results.find((r) => r.kind === "mcp")).toBeUndefined();
     }),
   it.effect("stamps a sanitized endpoint on the detect span", () =>
     Effect.gen(function* () {
       const spans: Array<Tracer.NativeSpan> = [];
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.integrations
         .detect(`http://svc-user:${USERINFO_PASSWORD}@127.0.0.1:1/api/mcp?token=${QUERY_TOKEN}`)
   it.effect("stamps a sanitized endpoint on the probe_endpoint span", () =>
     Effect.gen(function* () {
       const spans: Array<Tracer.NativeSpan> = [];
-      const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+      );
       yield* executor.mcp
         .probeEndpoint(`http://127.0.0.1:1/mcp?token=${QUERY_TOKEN}`)
     Effect.scoped(
       Effect.gen(function* () {
         const config = makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             memoryCredentialsPlugin(),
             mcpPlugin({ dangerouslyAllowStdioMCP: true }),
     Effect.scoped(
       Effect.gen(function* () {
         const config = makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             memoryCredentialsPlugin(),
             mcpPlugin({ dangerouslyAllowStdioMCP: true }),
       Effect.scoped(
         Effect.gen(function* () {
           const config = makeTestConfig({
+            access: testAccess.member(),
             plugins: [
               memoryCredentialsPlugin(),
               mcpPlugin({ dangerouslyAllowStdioMCP: true }),
     Effect.scoped(
       Effect.gen(function* () {
         const config = makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             memoryCredentialsPlugin(),
             mcpPlugin({ dangerouslyAllowStdioMCP: true }),

packages/plugins/mcp/src/sdk/probe-shape-real-servers.live.test.ts+4−1

 import { mcpPlugin } from "./plugin";
 import { probeMcpEndpointShape } from "./probe-shape";
+import { testAccess } from "@executor-js/product-access/testing";
 const MCP_INITIALIZE_BODY = JSON.stringify({
   jsonrpc: "2.0",
 const runEndpointProbe = (url: string): Effect.Effect<EndpointProbeOutcome> =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: [mcpPlugin()] as const }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: [mcpPlugin()] as const }),
+    );
     return yield* executor.mcp.probeEndpoint(url).pipe(
       Effect.map(
         (r) =>

packages/plugins/mcp/src/sdk/slack-connect-file.integration.test.ts+2−0

 import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testing";
 import { mcpPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const FILE_ID = "F012ABC3456";
 const IMAGE_BYTES = new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10]);
       Effect.gen(function* () {
         const config = {
           ...makeTestConfig({
+            access: testAccess.member(),
             plugins: [
               memoryCredentialsPlugin(),
               mcpPlugin({ httpClientLayer: slackFallbackHttpClientLayer }),

packages/plugins/onepassword/package.json+1−0

@@ -60,6 +60,7 @@ · 59 unmodified lines
60	"devDependencies": {	60	"devDependencies": {
61	"@effect/vitest": "catalog:",	61	"@effect/vitest": "catalog:",
62	"@executor-js/api": "workspace:*",	62	"@executor-js/api": "workspace:*",
		63	"@executor-js/product-access": "workspace:*",
63	"@types/node": "catalog:",	64	"@types/node": "catalog:",
64	"@types/react": "catalog:",	65	"@types/react": "catalog:",
65	"bun-types": "catalog:",	66	"bun-types": "catalog:",

packages/plugins/onepassword/src/sdk/plugin.test.ts+8−6

 import type { OnePasswordService } from "./service";
 import { OnePasswordError } from "./errors";
 import { OnePasswordAccount, OnePasswordConfig, DesktopAppAuth } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 // removed: v1 routed configure/removeConfig through an explicit `ScopeId`
 // (`executor.onepassword.configure(config, ScopeId.make("test-scope"))`) and
   it.effect("registers onepassword as a credential provider", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       const providers = yield* executor.providers.list();
       expect(providers).toContain(ONEPASSWORD);
   it.effect("configure upserts accounts by id and removeConfig removes them one by one", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       const initial = yield* executor.onepassword.getConfig();
   it.effect("removeConfig without an id removes everything", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       yield* executor.onepassword.configure({
         name: "Work",
   it.effect("getConfig redacts every account's service-account token", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       yield* executor.onepassword.configure({
   it.effect("exposes provider configuration as agent-callable static tools", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       const configured = yield* executor.execute(
   it.effect("status reports not-configured before configure", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [onepasswordPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [onepasswordPlugin()] as const }),
       );
       const status = yield* executor.onepassword.status();
       expect(status.connected).toBe(false);
       makeInMemoryBlobStore(),
       { org: "org_test", user: null },
       "onepassword",
+      { owners: ["org"], storageWrites: "allowed" },
     );
     return { blobs, store: makeOnePasswordStore(blobs) };
   };

packages/plugins/openapi/package.json+1−0

@@ -86,6 +86,7 @@ · 85 unmodified lines
86	"@effect/atom-react": "catalog:",	86	"@effect/atom-react": "catalog:",
87	"@effect/vitest": "catalog:",	87	"@effect/vitest": "catalog:",
88	"@executor-js/api": "workspace:*",	88	"@executor-js/api": "workspace:*",
		89	"@executor-js/product-access": "workspace:*",
89	"@executor-js/react": "workspace:*",	90	"@executor-js/react": "workspace:*",
90	"@types/js-yaml": "4.0.9",	91	"@types/js-yaml": "4.0.9",
91	"@types/node": "catalog:",	92	"@types/node": "catalog:",

packages/plugins/openapi/src/providers/google/spec-format-adapter.test.ts+4−0

 import { deriveGoogleDiscoveryIdentity, googleDiscoveryAdapter } from "./spec-format-adapter";
 import { googleCatalog } from "./presets";
+import { testAccess } from "@executor-js/product-access/testing";
 const TASKS_URL = "https://www.googleapis.com/discovery/v1/apis/tasks/v1/rest";
 const GMAIL_URL = "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest";
   Effect.gen(function* () {
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({
             httpClientLayer: discoveryHttpClientLayer,
       );
       const executor = yield* createExecutor(
         makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             openApiPlugin({
               httpClientLayer: discoveryHttpClientLayer,
     );
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({
             httpClientLayer: gmailDiscoveryHttpClientLayer,

packages/plugins/openapi/src/sdk/configure.test.ts+25−8

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
   it.effect("adds a custom apiKey method and getConfig reflects it", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("appends to an existing spec-derived template without dropping entries", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const seedTemplate: AuthenticationInput = {
           slug: "seed",
   it.effect("generates a custom_<id> slug for a method submitted without one", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("dedupes: a matching slug replaces in place; two slugless get distinct slugs", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("replace mode overwrites the auth template array", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const seedTemplate: AuthenticationInput = {
           slug: "seed",
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
   it.effect("getConfig returns null for an unknown integration", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         expect(yield* executor.openapi.getConfig("nope")).toBeNull();
       }),
     ),

packages/plugins/openapi/src/sdk/form-urlencoded-body.test.ts+22−23

@@ -30,6 +30,7 @@ import { · 29 unmodified lines
30	} from "@executor-js/plugin-openapi/testing";	30	} from "@executor-js/plugin-openapi/testing";
31		31
32	import { openApiPlugin } from "./plugin";	32	import { openApiPlugin } from "./plugin";
		33	import { testAccess } from "@executor-js/product-access/testing";
33		34
34	type Captured = {	35	type Captured = {
35	contentType: string;	36	contentType: string;
@@ -76,30 +77,28 @@ const plugins = [ · 40 unmodified lines
76	memoryCredentialsPlugin(),	77	memoryCredentialsPlugin(),
77	] as const;	78	] as const;
78		79
79	layer(	80	layer(makeTestWorkspaceLayer({ access: testAccess.member(), plugins }), { timeout: "15 seconds" })(
80	makeTestWorkspaceLayer({	81	"OpenAPI non-JSON request body serialization",
81	plugins,	82	(it) => {
82	}),	83	it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>
83	{ timeout: "15 seconds" },	84	Effect.gen(function* () {
84	)("OpenAPI non-JSON request body serialization", (it) => {	85	const { server, captured } = yield* startEchoServer();
85	it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>	86	const { config } = yield* TestWorkspace;
86	Effect.gen(function* () {	87	const executor = yield* createExecutor({ ...config, plugins });
87	const { server, captured } = yield* startEchoServer();
88	const { config } = yield* TestWorkspace;
89	const executor = yield* createExecutor({ ...config, plugins });
90		88
91	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });	89	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });
92		90
93	yield* executor.execute(conn.address("forms.submit"), {	91	yield* executor.execute(conn.address("forms.submit"), {
94	body: { name: "Acme", email: "a@b.com" },	92	body: { name: "Acme", email: "a@b.com" },
95	});	93	});
96		94
97	expect(captured.contentType).toBe("application/x-www-form-urlencoded");	95	expect(captured.contentType).toBe("application/x-www-form-urlencoded");
98	expect(captured.body).not.toBe("[object Object]");	96	expect(captured.body).not.toBe("[object Object]");
99		97
100	const parsed = new URLSearchParams(captured.body);	98	const parsed = new URLSearchParams(captured.body);
101	expect(parsed.get("name")).toBe("Acme");	99	expect(parsed.get("name")).toBe("Acme");
102	expect(parsed.get("email")).toBe("a@b.com");	100	expect(parsed.get("email")).toBe("a@b.com");
103	}),	101	}),
104	);	102	);
105	});	103	},
		104	);

packages/plugins/openapi/src/sdk/health-check-redaction.test.ts+2−0

 import { serveOpenApiHttpApiTestServer } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 /** The credential the connection authenticates with. Longer than the sample's
  *  120-char value cap on purpose: truncating before scrubbing would leave a
     });
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({ httpClientLayer: FetchHttpClient.layer }),
           memoryCredentialsPlugin(),

packages/plugins/openapi/src/sdk/multi-scope-bearer.test.ts+4−1

 import { openApiPlugin } from "./plugin";
 import { type AuthenticationInput } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Test API — a single endpoint that echoes the Authorization header so the
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveVercel();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // Admin uploads the spec once; the integration declares a bearer
         // template but no token value.

packages/plugins/openapi/src/sdk/non-json-body.test.ts+106−35

 } from "@executor-js/plugin-openapi/testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const JsonNameBody = Schema.fromJsonString(
   Schema.Struct({
         payload: ObjectBody.pipe(HttpApiSchema.asMultipart()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mp" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "paperless" });
       const schema = yield* executor.tools.schema(conn.address("body.upload"));
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "pages" });
       const schema = yield* executor.tools.schema(conn.address("body.uploadPages"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "broken" });
       const exit = yield* executor
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes" });
       // The rewrite is scoped to multipart bodies: a JSON body keeps its
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes-jsonapi" });
       yield* executor.execute(conn.address("body.createNote"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mixed" });
       const schema = yield* executor.tools.schema(conn.address("body.uploadMixed"));
         },
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "reffed" });
       // Documented limitation: component schemas are carried through
         payload: Schema.String.pipe(HttpApiSchema.asText({ contentType: "application/xml" })),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "xml" });
         transformSpec: replaceRequestBodyContent("/submit", "post", contentFor("text/xml")),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tx" });
         payload: Schema.String.pipe(HttpApiSchema.asText()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tp" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64_bad" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_nested_b64_bad",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_b64_missing",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_object_body",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_string_body",
           }),
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail" });
         const schema = yield* executor.tools.schema(conn.address("gmail.getAttachment"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_text" });
       const result = yield* executor.execute(conn.address("gmailText.getAttachment"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "zip_attachment" });
       const result = yield* executor.execute(conn.address("zipAttachment.getAttachment"), {
           ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_meta" });
       const result = yield* executor.execute(conn.address("gmailMeta.getAttachment"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
       const schema = yield* executor.tools.schema(conn.address("files.download"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
       const result = yield* executor.execute(conn.address("files.download"), {
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc" });
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc2" });
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64" });
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_bad_ct" });
           },
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_schema" });
       const { server } = yield* startEchoServer({
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "mc3",
       const { server } = yield* startEchoServer({
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_schema" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mpe" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fe" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fd" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // No encoding → OAS3 defaults: style=form, explode=true.
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fdx" });

packages/plugins/openapi/src/sdk/plugin.test.ts+104−35

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const TOOL_ERROR_TYPESCRIPT =
   "{ code: string; message: string; status?: number; details?: unknown; retryable?: boolean }";
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const preview = yield* executor.openapi.previewSpec(server.specJson);
       Effect.gen(function* () {
         const server = yield* serveOAuthDiscoverableOpenApiSpec();
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: testPlugins(server.httpClientLayer) }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: testPlugins(server.httpClientLayer),
+          }),
         );
         const preview = yield* executor.openapi.previewSpec(server.url("/api/schema/"));
   it.effect("exposes static openapi executor control tools via execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // v2: static control tools are NOT part of `tools.list()` (that's the
       // persisted per-connection catalog) and aren't `tools.schema()`-resolvable;
   it.effect("invokes static previewSpec through executor.execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const preview = unwrapInvocation(
         yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
   it.effect("invokes static addSpec through executor.execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const result = unwrapInvocation(
         yield* executor.execute(ToolAddress.make("executor.openapi.addSpec"), {
     Effect.scoped(
       Effect.gen(function* () {
         const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "url", url: specServer.specUrl },
   it.effect("static previewSpec returns actionable tool failures", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [openApiPlugin()] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [openApiPlugin()] as const,
+      });
       const executor = yield* createExecutor(config);
       const result = yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
   it.effect("requires approval before adding an integration through the runtime tool", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [openApiPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [openApiPlugin()] as const }),
       );
       const declined = yield* executor
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const failure = yield* executor
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const multiServer = {
           ...server,
           specJson: makeOpenApiTestSpecJson(TestApi, {
         const server = yield* serveOpenApiEchoTestServer({
           transformSpec: withEchoCookieParameter,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, {
           slug: "cookie_params",
           headers: { Cookie: "configured=yes" },
         const server = yield* serveOpenApiEchoTestServer({
           transformSpec: withEchoCookieParameter,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, {
           slug: "cookie_unknown",
         });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "records" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // The spec declares bearer auth; the caller passes NO template — the
         // agentic add path (MCP/API) does exactly this. Without server-side
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // No baseUrl override: the spec declares `servers`, so the host is
         // resolved per call from the operation's servers rather than baked into
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // The add page sends [] when the user deletes every detected method.
         // That intent must survive — deriving methods back from the spec here
   it.effect("addSpec accepts Graph-sized OpenAPI blobs", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const largeDescription = "x".repeat(36 * 1024 * 1024);
       const added = yield* executor.openapi.addSpec({
     "addSpec accepts Microsoft Graph-scale operation catalogs from one spec",
     () =>
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const added = yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: microsoftGraphScaleSpecText() },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* addOpenApiTestConnection(executor, server, { slug: "removable" });
         expect((yield* executor.tools.list()).map((t) => String(t.name))).toContain(
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // First add carries an apiKey auth template + a distinctive description.
         // A silent upsert on re-add would clobber both.
         // The mutable spec server is a real 127.0.0.1 listener — reach it over
         // the default fetch-based client, like production would.
         const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const added = yield* executor.openapi.addSpec({
           spec: { kind: "url", url: specServer.specUrl },
   it.effect("denies member updateSpec before writing an org blob", () =>
     Effect.gen(function* () {
       const blobs = recordingBlobStore();
-      const config = makeTestConfig({ plugins: testPlugins() });
+      const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
       const admin = yield* createExecutor({ ...config, blobs: blobs.store });
       yield* admin.openapi.addSpec({
         spec: { kind: "blob", value: testApiSpecText() },
       const member = yield* createExecutor({
         ...config,
         blobs: blobs.store,
-        orgWrites: "denied",
+        access: testAccess.member("denied"),
       });
       const error = yield* member.openapi
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* addOpenApiTestConnection(executor, server, { slug: "pasted" });
         // A pasted-blob integration has no source URL — re-fetch must say so.
         const plugins = testPlugins();
         const alice = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "alice",
         });
         const bob = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "bob",
   it.effect("updateSpec on an unknown slug fails with IntegrationNotFoundError", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const error = yield* executor.openapi.updateSpec("missing").pipe(Effect.flip);
       expect(Predicate.isTagged(error, "IntegrationNotFoundError")).toBe(true);
     }),

packages/plugins/openapi/src/sdk/real-specs.test.ts+2−0

 import { deriveAuthenticationTemplateFromPreview } from "./derive-auth";
 import { previewSpec as previewSpecRaw } from "./preview";
 import type { ExtractionResult } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 const previewSpec = (input: string) =>
   previewSpecRaw(input).pipe(Effect.provide(FetchHttpClient.layer));
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [openApiPlugin(), memoryCredentialsPlugin()] as const,
       }),
     );

packages/plugins/openapi/src/sdk/response-body-timeout.test.ts+4−1

 import { makeOpenApiHttpApiTestIntegrationConfig } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const BODY_READ_DEADLINE_MS = 15_000;
 const RESPONSE_BODY_TIMEOUT_MS = 100;
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, {
         slug: "body_timeout",

packages/plugins/openapi/src/sdk/response-headers-timeout.test.ts+4−1

 import { invokeWithLayer } from "./invoke";
 import { openApiPlugin } from "./plugin";
 import type { OperationBinding } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 const RESPONSE_HEADERS_TIMEOUT_MS = 100;
 const STREAM_TOOL = "logs.getLogs";
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, { slug: "headers_timeout", baseUrl }),
     );

packages/plugins/openapi/src/sdk/spec-blob.test.ts+15−6

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
   it.effect("addSpec stores a content pointer, not the inline spec text", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const text = specText();
         yield* executor.openapi.addSpec({
           api: TestApi,
           handlersLayer: EchoGroupLive,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     () =>
       Effect.scoped(
         Effect.gen(function* () {
-          const config = makeTestConfig({ plugins: testPlugins() });
+          const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
           const executor = yield* createExecutor(config);
           const text = specTextWithDefinition();
           const hash = yield* sha256Hex(text);
   it.effect("stale sync preserves tools and definitions when the spec blob is missing", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const config = makeTestConfig({ plugins: testPlugins() });
+        const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
         const executor = yield* createExecutor(config);
         const text = specTextWithDefinition();
         const hash = yield* sha256Hex(text);
   it.effect("explicit spec refresh accepts a valid OpenAPI document with zero operations", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const emptySpec = JSON.stringify({
           openapi: "3.1.0",
           info: { title: "Empty", version: "1.0.0" },
   it.effect("remove + re-add of the same spec is idempotent over the shared blob", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const text = specText();
         yield* executor.openapi.addSpec({ spec: { kind: "blob", value: text }, slug: "re_add" });

packages/plugins/openapi/src/sdk/spec-overrides-lifecycle.test.ts+10−3

 import { openApiPlugin } from "./plugin";
 import { applySpecOverrides, type SpecOverrides } from "./spec-overrides";
 import { serveMutableOpenApiSpecTestServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = () =>
   [openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
   it.effect("applies scope overrides to preview and persists raw and patched hashes", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const sourceText = encodeJsonText(oauthSpec);
         const preview = yield* executor.openapi.previewSpec({
   it.effect("changes and clears overrides for an inline spec without repasting the source", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const sourceText = encodeJsonText(oauthSpec);
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: sourceText },
           .add(HttpApiEndpoint.post("create", "/items", { success: Schema.String }));
         const InitialApi = HttpApi.make("initial").add(Items);
         const server = yield* serveMutableOpenApiSpecTestServer({ initialApi: InitialApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const removeList: SpecOverrides = [{ op: "remove", path: "/paths/~1items/get" }];
         yield* executor.openapi.addSpec({

packages/plugins/openapi/src/sdk/streaming-response.test.ts+7−2

 import { collectStreamingBody, STREAM_MAX_BYTES } from "./invoke";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = () =>
   [openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(StreamingApi, { slug: "streaming", baseUrl }),
     );
         );
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       yield* executor.openapi.addSpec({
         spec: {
           kind: "blob",

packages/plugins/openapi/src/sdk/tool-row-projection.test.ts+4−1

 import { openApiPlugin } from "./plugin";
 import { serveOpenApiHttpApiTestServer, unwrapInvocation } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
     api: TestApi,
     handlersLayer: EchoGroupLive,
   });
-  const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+  const executor = yield* createExecutor(
+    makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+  );
   yield* executor.openapi.addSpec({
     spec: { kind: "blob", value: server.specJson },
     slug: "proj_api",

packages/plugins/openapi/src/sdk/upstream-failures.test.ts+8−3

 } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 class AdapterDefect extends Data.TaggedError("AdapterDefect") {}
 const buildExecutor = (baseUrl: string, httpClientLayer = FetchHttpClient.layer) =>
   Effect.gen(function* () {
     const executor = yield* createExecutor(
-      makeTestConfig({ plugins: testPlugins(httpClientLayer) }),
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins(httpClientLayer) }),
     );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(FailureApi, { slug: "f", baseUrl }),
 const buildExecutorForOpenApiServer = (server: OpenApiTestServerShape) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     const conn = yield* addOpenApiTestConnection(executor, server, { slug: "f" });
     return { executor, address: conn.address(LIST_THINGS) };
   });
         headers: { "content-type": "application/json" },
         body: '{"error":{"status":"PERMISSION_DENIED","details":[{"reason":"ACCESS_TOKEN_SCOPE_INSUFFICIENT"}]}}',
       }));
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // Declare the operation's scope in the spec blob before registering it,
       // so the extracted binding carries requiredScopes.
       const SpecJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));

packages/plugins/toolkits/package.json+1−0

@@ -56,6 +56,7 @@ · 55 unmodified lines
56	"@effect/atom-react": "catalog:",	56	"@effect/atom-react": "catalog:",
57	"@effect/vitest": "catalog:",	57	"@effect/vitest": "catalog:",
58	"@executor-js/api": "workspace:*",	58	"@executor-js/api": "workspace:*",
		59	"@executor-js/product-access": "workspace:*",
59	"@executor-js/react": "workspace:*",	60	"@executor-js/react": "workspace:*",
60	"@tanstack/react-router": "catalog:",	61	"@tanstack/react-router": "catalog:",
61	"@types/node": "catalog:",	62	"@types/node": "catalog:",

packages/plugins/toolkits/src/server.test.ts+6−0

 import { makeTestExecutor } from "@executor-js/sdk/testing";
 import { toolkitsPlugin } from "./server";
+import { testAccess } from "@executor-js/product-access/testing";
 describe("toolkitsPlugin", () => {
   it.effect("creates toolkits and manages ordered policy rules", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [toolkitsPlugin()] as const,
       });
   it.effect("rejects duplicate visible slugs", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [toolkitsPlugin()] as const,
       });
       yield* executor.toolkits.create({ owner: "org", name: "Deploy Kit" });
   it.effect("resolves toolkit policies with implicit deny and workspace owner limits", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [toolkitsPlugin()] as const,
       });
   it.effect("treats a persisted connection-root approve as an access policy", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [toolkitsPlugin()] as const,
       });
   it.effect("applies a broad approve policy over a narrower connection", () =>
     Effect.gen(function* () {
       const executor = yield* makeTestExecutor({
+        access: testAccess.member(),
         plugins: [toolkitsPlugin()] as const,
       });

packages/react/package.json+1−0

@@ -36,6 +36,7 @@ · 35 unmodified lines
36	"@base-ui/react": "^1.3.0",	36	"@base-ui/react": "^1.3.0",
37	"@effect/atom-react": "catalog:",	37	"@effect/atom-react": "catalog:",
38	"@executor-js/api": "workspace:*",	38	"@executor-js/api": "workspace:*",
		39	"@executor-js/product-access": "workspace:*",
39	"@executor-js/sdk": "workspace:*",	40	"@executor-js/sdk": "workspace:*",
40	"@hookform/resolvers": "^5.2.2",	41	"@hookform/resolvers": "^5.2.2",
41	"@lobehub/icons": "^5.4.0",	42	"@lobehub/icons": "^5.4.0",

packages/react/src/pages/integration-detail.tsx+1−1

   AuthTemplateSlug,
   IntegrationSlug,
   ToolAddress,
-  effectivePolicyFromSorted,
   type Connection,
   type Owner,
 } from "@executor-js/sdk/shared";
+import { effectivePolicyFromSorted } from "@executor-js/product-access/policy";
 import {
   checkConnectionHealth,
   connectionsAllAtom,

packages/react/src/pages/tools.tsx+2−1

@@ -2,7 +2,8 @@ import { useMemo, useState } from "react"; · 1 unmodified line
2	import { Link } from "@tanstack/react-router";	2	import { Link } from "@tanstack/react-router";
3	import { useAtomRefresh, useAtomValue } from "@effect/atom-react";	3	import { useAtomRefresh, useAtomValue } from "@effect/atom-react";
4	import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";	4	import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
5	import { ToolAddress, effectivePolicyFromSorted } from "@executor-js/sdk/shared";	5	import { ToolAddress } from "@executor-js/sdk/shared";
		6	import { effectivePolicyFromSorted } from "@executor-js/product-access/policy";
6		7
7	import { policiesOptimisticAtom, toolsAllAtom } from "../api/atoms";	8	import { policiesOptimisticAtom, toolsAllAtom } from "../api/atoms";
8	import { usePolicyActions } from "../hooks/use-policy-actions";	9	import { usePolicyActions } from "../hooks/use-policy-actions";

scripts/publish-packages.ts+1−0

@@ -31,6 +31,7 @@ const PUBLIC_PACKAGE_DIRS = [ · 30 unmodified lines
31	"packages/kernel/core",	31	"packages/kernel/core",
32	"packages/kernel/runtime-quickjs",	32	"packages/kernel/runtime-quickjs",
33	"packages/core/sdk",	33	"packages/core/sdk",
		34	"packages/core/product-access",
34	"packages/core/config",	35	"packages/core/config",
35	"packages/core/execution",	36	"packages/core/execution",
36	"packages/core/cli",	37	"packages/core/cli",

scripts/smoke-docs-install.ts+40−5

  * name (`@executor-js/sdk`) instead of relying on workspace resolution.
  */
 import { $ } from "bun";
+import { Schema } from "effect";
 import { existsSync, readdirSync } from "node:fs";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const documentedPackages = ["@executor-js/sdk", "@executor-js/plugin-openapi"] as const;
+const documentedPackages = [
+  "@executor-js/sdk",
+  "@executor-js/product-access",
+  "@executor-js/plugin-openapi",
+] as const;
 const publicPackageDirs = [
   "packages/core/fumadb",
   "packages/core/sdk",
+  "packages/core/product-access",
   "packages/core/config",
   "packages/plugins/openapi",
 ] as const;
   return (JSON.parse(raw) as { name: string }).name;
 };
+// `effect` is the SDK's (and product-access's) required peer, and the docs
+// install command tells consumers to add it themselves. `npm install
+// --legacy-peer-deps` below skips auto-installing peers, so the fixture must
+// declare it like a real consumer would — pinned from the workspace catalog
+// so it matches what the packed manifests resolved `catalog:` to.
+const decodeCatalog = Schema.decodeUnknownSync(
+  Schema.Struct({ catalog: Schema.Struct({ effect: Schema.NonEmptyString }) }),
+);
+const readCatalogEffectVersion = async (): Promise<string> => {
+  const raw = await readFile(join(repoRoot, "package.json"), "utf8");
+  const manifest = decodeCatalog(JSON.parse(raw));
+  return manifest.catalog.effect;
+};
 const findTarball = (pkgDir: string, packageName: string): string => {
   const tarball = readdirSync(pkgDir).find((entry) => entry.endsWith(".tgz"));
   if (!tarball) {
 const tmp = await mkdtemp(join(tmpdir(), "executor-docs-install-"));
 try {
-  const dependencies: Record<string, string> = {};
+  const dependencies: Record<string, string> = { effect: await readCatalogEffectVersion() };
   const overrides: Record<string, string> = {};
   for (const [name, tarball] of tarballs) {
     overrides[name] = `file:${tarball}`;
   }
   console.log(`[docs-smoke] import documented SDK packages`);
-  await $`node --input-type=module --eval ${`const sdk = await import("@executor-js/sdk"); const openapi = await import("@executor-js/plugin-openapi"); if (typeof sdk.createExecutor !== "function") throw new Error("missing createExecutor"); if (typeof openapi.openApiPlugin !== "function") throw new Error("missing openApiPlugin");`}`.cwd(
+  // The documented minimal embed: the SDK root export is the Promise façade
-    tmp,
+  // and ships no access posture of its own, so the probe constructs a
-  );
+  // subject-less workspace-service executor with the posture from
+  // `@executor-js/product-access` (ephemeral in-memory backend, nothing
+  // invoked over the network) and closes it.
+  const importProbe = [
+    `const sdk = await import("@executor-js/sdk");`,
+    `const access = await import("@executor-js/product-access");`,
+    `const openapi = await import("@executor-js/plugin-openapi");`,
+    `if (typeof sdk.createExecutor !== "function") throw new Error("missing createExecutor");`,
+    `if (typeof access.workspaceServiceAccess !== "function") throw new Error("missing workspaceServiceAccess");`,
+    `if (typeof openapi.openApiPlugin !== "function") throw new Error("missing openApiPlugin");`,
+    `const executor = await sdk.createExecutor({ access: access.workspaceServiceAccess(), onElicitation: "accept-all" });`,
+    `if (typeof executor.close !== "function") throw new Error("missing executor.close");`,
+    `await executor.close();`,
+  ].join("\n");
+  await $`node --input-type=module --eval ${importProbe}`.cwd(tmp);
 } finally {
   await rm(tmp, { recursive: true, force: true });
 }

scripts/smoke-test-packed.ts+1−0

@@ -37,6 +37,7 @@ const PUBLIC_PACKAGE_DIRS = [ · 36 unmodified lines
37	"packages/kernel/core",	37	"packages/kernel/core",
38	"packages/kernel/runtime-quickjs",	38	"packages/kernel/runtime-quickjs",
39	"packages/core/sdk",	39	"packages/core/sdk",
		40	"packages/core/product-access",
40	"packages/core/config",	41	"packages/core/config",
41	"packages/core/execution",	42	"packages/core/execution",
42	"packages/core/cli",	43	"packages/core/cli",