diff --git a/.claude/rules/sim-content-delivery.md b/.claude/rules/sim-content-delivery.md
new file mode 100644
index 00000000000..6d976d8471d
--- /dev/null
+++ b/.claude/rules/sim-content-delivery.md
@@ -0,0 +1,104 @@
+---
+description: How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content.
+paths:
+  - "apps/sim/lib/core/application/**"
+  - "apps/sim/lib/mothership/content-delivery/**"
+  - "apps/sim/lib/workspace-files/application/**"
+  - "apps/sim/lib/knowledge/application/**"
+  - "apps/sim/lib/table/application/**"
+  - "apps/sim/lib/workflows/application/**"
+  - "apps/sim/lib/mothership/chat/application/**"
+  - "apps/sim/lib/**/application/operations.ts"
+  - "apps/sim/lib/mothership/agent-cli/**"
+  - "apps/sim/lib/mothership/tools/**"
+  - "apps/sim/app/api/v2/**"
+---
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, and public links. Counts, ordering, and match locations are ordinary
+metadata; this boundary protects supported literal secret values, not arbitrary inference. Intentional
+human uploads remain ordinary input and are not scanned.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+    Settled tool results use the same deferral, but do not claim that a mutation was saved.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
+  single-file download (`files get`) admits it under `unknown: 'taint'`, which latches the call's
+  registry so the whole output is withheld and the workbench copy stays unknown. It needs a
+  registry to latch; without one it refuses. One refused item never latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store, `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run lib/api/server/routes/copilot-route-inventory.test.ts --update=all`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
+| Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out, reported in the archive manifest | Left out (opaque), reported in the archive manifest | Included |
+| `files search` | Match location kept; clipped preview withheld | Same; read/grep provides safely redacted text | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Actual file read refused | Evidence imported before broker bytes/errors return | Compiles, including dynamic file references |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export | Stream fails before refused source bytes; no successful archive receipt | Refused (opaque) | Streams originals/chunks with admission at each source |
+| Table export download | Existing unsupported Chat operation | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Locations returned without cell values | Same | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
+| `tools execute` | Settled result withheld, with no automatic retry | Named masking through the existing registry | Returned, subject to existing tool authorization |
+
+Search pagination and aggregate totals retain their database meaning even when an item or preview is
+withheld. Do not scan unrelated table rows or whole document collections to conceal counts.
+A refused requested mount stops code before it runs, avoiding an older file at the same sandbox path.
+Registry admission commits only when the complete item fits the existing capacity; a refused item
+must not consume capacity or permanently disable the parent registry.
diff --git a/.cursor/rules/sim-content-delivery.mdc b/.cursor/rules/sim-content-delivery.mdc
new file mode 100644
index 00000000000..4e1b90df027
--- /dev/null
+++ b/.cursor/rules/sim-content-delivery.mdc
@@ -0,0 +1,95 @@
+---
+description: "How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content."
+globs: ["apps/sim/lib/core/application/**","apps/sim/lib/mothership/content-delivery/**","apps/sim/lib/workspace-files/application/**","apps/sim/lib/knowledge/application/**","apps/sim/lib/table/application/**","apps/sim/lib/workflows/application/**","apps/sim/lib/mothership/chat/application/**","apps/sim/lib/**/application/operations.ts","apps/sim/lib/mothership/agent-cli/**","apps/sim/lib/mothership/tools/**","apps/sim/app/api/v2/**"]
+---
+
+<!-- Generated from .claude/rules/sim-content-delivery.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, and public links. Counts, ordering, and match locations are ordinary
+metadata; this boundary protects supported literal secret values, not arbitrary inference. Intentional
+human uploads remain ordinary input and are not scanned.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+    Settled tool results use the same deferral, but do not claim that a mutation was saved.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
+  single-file download (`files get`) admits it under `unknown: 'taint'`, which latches the call's
+  registry so the whole output is withheld and the workbench copy stays unknown. It needs a
+  registry to latch; without one it refuses. One refused item never latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store, `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run lib/api/server/routes/copilot-route-inventory.test.ts --update=all`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
+| Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out, reported in the archive manifest | Left out (opaque), reported in the archive manifest | Included |
+| `files search` | Match location kept; clipped preview withheld | Same; read/grep provides safely redacted text | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation, and seeing an existing link (any surface, run_code included) | 403 | 403 (a link leaves every gate) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Actual file read refused | Evidence imported before broker bytes/errors return | Compiles, including dynamic file references |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export | Stream fails before refused source bytes; no successful archive receipt | Refused (opaque) | Streams originals/chunks with admission at each source |
+| Table export download | Existing unsupported Chat operation | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Locations returned without cell values | Same | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries; a row whose coercion rewrote a secret, or whose raw cells cannot be checked, is stored unknown | Exact-empty, as before |
+| `tools execute` | Settled result withheld, with no automatic retry | Named masking through the existing registry | Returned, subject to existing tool authorization |
+
+Search pagination and aggregate totals retain their database meaning even when an item or preview is
+withheld. Do not scan unrelated table rows or whole document collections to conceal counts.
+A refused requested mount stops code before it runs, avoiding an older file at the same sandbox path.
+Registry admission commits only when the complete item fits the existing capacity; a refused item
+must not consume capacity or permanently disable the parent registry.
diff --git a/apps/sim/AGENTS.md b/apps/sim/AGENTS.md
index 9da2a087205..8f3822fa977 100644
--- a/apps/sim/AGENTS.md
+++ b/apps/sim/AGENTS.md
@@ -9,6 +9,7 @@ Applies to `apps/sim/**` on top of the root [AGENTS.md](/AGENTS.md), which holds
 - Styling and emcn chrome, UI copy, settings pages: `sim-styling.md`, `sim-ui-copy.md`, `sim-settings-pages.md`
 - URL state, list and menu order, caching: `sim-url-state.md`, `sim-list-ordering.md`, `sim-caching.md`
 - Tools, blocks, triggers: `sim-integrations.md`; isolated-vm sandbox worker: `sim-sandbox.md`
+- Anything that returns stored file, run-file, knowledge or table content to Chat: `sim-content-delivery.md`
 - Tests: `sim-testing.md` and the `test-audit` skill
 - Landing pages: `app/(landing)/CLAUDE.md`, `landing-seo-geo.md`, `constitution.md` (product language)
 
diff --git a/apps/sim/app/api/v2/files/bulk-download/route.test.ts b/apps/sim/app/api/v2/files/bulk-download/route.test.ts
index 2e98a0b3ce5..b2352f3c29b 100644
--- a/apps/sim/app/api/v2/files/bulk-download/route.test.ts
+++ b/apps/sim/app/api/v2/files/bulk-download/route.test.ts
@@ -76,6 +76,7 @@ describe('GET /api/v2/files/bulk-download', () => {
       folderPaths: new Map<string, string>(),
       renderedDocuments: new Map<string, Buffer>(),
       declaredBytes: 6,
+      excludedFileIds: [],
     })
   })
 
diff --git a/apps/sim/app/api/v2/files/bulk-download/route.ts b/apps/sim/app/api/v2/files/bulk-download/route.ts
index f2322d778ce..5587caa1a16 100644
--- a/apps/sim/app/api/v2/files/bulk-download/route.ts
+++ b/apps/sim/app/api/v2/files/bulk-download/route.ts
@@ -54,14 +54,16 @@ export const GET = defineV2BinaryRoute({
     folderPaths: query.folderPaths,
   }),
   useCase: downloadWorkspaceFileItems,
-  present: ({ filesToZip, folderPaths, renderedDocuments }) => {
-    const entryPaths = buildZipEntryPaths(
-      filesToZip.map((file) => ({
+  present: ({ filesToZip, folderPaths, renderedDocuments, excludedFileIds }) => {
+    const report = excludedFileIds.length > 0 ? { partial: true, excludedFileIds } : undefined
+    const entryPaths = buildZipEntryPaths([
+      ...filesToZip.map((file) => ({
         name: file.name,
         folderPath: file.folderId ? folderPaths.get(file.folderId) : null,
         contentType: file.type,
-      }))
-    )
+      })),
+      ...(report ? [{ name: 'sim-download-report.json', contentType: 'application/json' }] : []),
+    ])
     const archive = new ZipArchive({ store: true })
     archive.on('warning', (error: Error) => {
       logger.warn('Archive warning while streaming workspace files', { error })
@@ -71,6 +73,9 @@ export const GET = defineV2BinaryRoute({
         name: entryPaths[index],
       })
     })
+    if (report) {
+      archive.append(JSON.stringify(report, null, 2), { name: entryPaths[filesToZip.length] })
+    }
     archive.finalize().catch((error) => {
       logger.error('Failed to finalize workspace file archive', { error })
     })
diff --git a/apps/sim/app/api/v2/lib/response.ts b/apps/sim/app/api/v2/lib/response.ts
index 30eaa7bb044..6b0db3d312e 100644
--- a/apps/sim/app/api/v2/lib/response.ts
+++ b/apps/sim/app/api/v2/lib/response.ts
@@ -10,6 +10,7 @@ import { type CursorKey, INVALID_CURSOR_MESSAGE } from '@/lib/api/list-query'
 import { getValidationErrorMessage, serializeZodIssues } from '@/lib/api/server'
 import { ADMISSION_RETRY_AFTER_SECONDS } from '@/lib/core/admission/transient-failure'
 import {
+  ContentDeliveryUnobservedError,
   forbiddenErrorDetails,
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
@@ -530,6 +531,10 @@ export function v2ErrorForOrchestration(
  * one its failure class maps to.
  */
 export function v2CaughtOrchestrationError(error: unknown): NextResponse | null {
+  /** Chat reached stored content outside any classifying surface: transient, never a content leak. */
+  if (error instanceof ContentDeliveryUnobservedError) {
+    return v2Error('SERVICE_UNAVAILABLE', error.message)
+  }
   const classified = asOrchestrationError(error)
   if (!classified) return null
   if (classified instanceof InsufficientScopeError) return v2InsufficientScope(classified)
diff --git a/apps/sim/ee/access-requests/lib/application/operations.ts b/apps/sim/ee/access-requests/lib/application/operations.ts
index 0af98a38bd9..13a313be0cc 100644
--- a/apps/sim/ee/access-requests/lib/application/operations.ts
+++ b/apps/sim/ee/access-requests/lib/application/operations.ts
@@ -51,6 +51,7 @@ function defineAccessRequestOperation(
          * permission-group-exempt: requests never grant a withheld capability without administrator review.
          */
         capability: 'none',
+        contentDelivery: 'none',
       })
   return Object.freeze({ ...workspaceOperation, organizationOperation, admin })
 }
diff --git a/apps/sim/ee/workspace-forking/application/operations.ts b/apps/sim/ee/workspace-forking/application/operations.ts
index e744d99f92f..878930fe49d 100644
--- a/apps/sim/ee/workspace-forking/application/operations.ts
+++ b/apps/sim/ee/workspace-forking/application/operations.ts
@@ -14,6 +14,7 @@ export const forkOperations = {
   discover: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.discover',
     oauthScope: 'api:read',
   }),
@@ -23,6 +24,7 @@ export const forkOperations = {
   preview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.preview',
     oauthScope: 'api:write',
   }),
@@ -32,6 +34,7 @@ export const forkOperations = {
   create: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.create',
     oauthScope: 'api:write',
   }),
@@ -41,6 +44,7 @@ export const forkOperations = {
   syncPreview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync.preview',
     oauthScope: 'api:write',
   }),
@@ -50,6 +54,7 @@ export const forkOperations = {
   sync: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync',
     oauthScope: 'api:write',
   }),
@@ -59,6 +64,7 @@ export const forkOperations = {
   mappingsRead: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.read',
     oauthScope: 'api:read',
   }),
@@ -68,6 +74,7 @@ export const forkOperations = {
   mappingsUpdate: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.update',
     oauthScope: 'api:write',
   }),
@@ -77,6 +84,7 @@ export const forkOperations = {
   rollback: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.rollback',
     oauthScope: 'api:write',
   }),
@@ -86,6 +94,7 @@ export const forkOperations = {
   unlink: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.unlink',
     oauthScope: 'api:write',
   }),
@@ -95,6 +104,7 @@ export const forkOperations = {
   exclusions: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.exclusions',
     oauthScope: 'api:write',
   }),
@@ -107,6 +117,7 @@ export const forkOperations = {
   syncDefault: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync_default',
     oauthScope: 'api:write',
   }),
diff --git a/apps/sim/executor/utils/resolved-secret-content-projection.ts b/apps/sim/executor/utils/resolved-secret-content-projection.ts
index bc7eb1f256f..be5d156c03c 100644
--- a/apps/sim/executor/utils/resolved-secret-content-projection.ts
+++ b/apps/sim/executor/utils/resolved-secret-content-projection.ts
@@ -93,6 +93,8 @@ interface ProjectionState {
 }
 
 export interface ResolvedSecretContentProjectionOptions {
+  /** Keeps original logical lines when masking complete text before a file line window. */
+  preserveLineBreaks?: boolean
   /** Values already materialized and verified by a boundary-specific projector. */
   isOpaqueSafeObject?: (value: object) => boolean
   /** Whether string-shaped secret literals should also match typed number/boolean/null values. */
@@ -304,13 +306,13 @@ function sanitizeProjectedString(
       ? sanitizeCollisionProneInternalDiagnosticIdentifiers(value, matcher)
       : value
   sanitized = matcher
-    ? sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch)
+    ? sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch, options)
     : sanitized
   if (options.sanitizeInternalIdentifiers) {
     sanitized = sanitizeInternalDiagnosticIdentifiers(sanitized)
   }
   if (matcher && containsResolvedSecret(sanitized, matcher)) {
-    sanitized = sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch)
+    sanitized = sanitizeResolvedSecretString(sanitized, matcher, maxBytes, options.onMatch, options)
     if (containsResolvedSecret(sanitized, matcher)) {
       throw new ResolvedSecretContentProjectionError(
         'Secret replacement could not produce safe model content'
diff --git a/apps/sim/executor/utils/resolved-secret-matcher.test.ts b/apps/sim/executor/utils/resolved-secret-matcher.test.ts
index 46f37faac0d..cf3fa96188e 100644
--- a/apps/sim/executor/utils/resolved-secret-matcher.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-matcher.test.ts
@@ -11,6 +11,31 @@ import {
 const PRESERVE_NAMED_PROVENANCE = { preserveNamedProvenanceLabels: true } as const
 
 describe('resolved secret matcher', () => {
+  it.each([
+    ['first-line\nsecond-line', '{{TOKEN}}\n{{TOKEN}}'],
+    ['first-line\r\nsecond-line', '{{TOKEN}}\r\n{{TOKEN}}'],
+    ['first-line\nsecond-line\n', '{{TOKEN}}\n{{TOKEN}}\n'],
+    ['first-line\n\nsecond-line', '{{TOKEN}}\n{{TOKEN}}\n{{TOKEN}}'],
+    ['\n'.repeat(8), '{{TOKEN}}\n'.repeat(8)],
+  ])(
+    'preserves line boundaries for a complete literal %j when selecting file lines',
+    (plaintext, expected) => {
+      const matcher = createResolvedSecretMatcher([{ plaintext, replacement: '{{TOKEN}}' }])
+      if (!matcher) throw new Error('Fixture literal did not produce a matcher')
+      expect(
+        sanitizeResolvedSecretString(plaintext, matcher, undefined, undefined, {
+          preserveLineBreaks: true,
+        })
+      ).toBe(expected)
+      expect(sanitizeResolvedSecretString(plaintext, matcher)).toBe('{{TOKEN}}')
+      expect(
+        sanitizeResolvedSecretString(`before ${plaintext} after`, matcher, undefined, undefined, {
+          preserveLineBreaks: true,
+        })
+      ).toBe(`before ${expected} after`)
+    }
+  )
+
   it('reports each matched literal once across large repeated content', () => {
     const matcher = createResolvedSecretMatcher([
       { plaintext: 'xxxxxxxx', replacement: '{{SHORT}}' },
diff --git a/apps/sim/executor/utils/resolved-secret-matcher.ts b/apps/sim/executor/utils/resolved-secret-matcher.ts
index 7ea20237747..2cafdb9cdb2 100644
--- a/apps/sim/executor/utils/resolved-secret-matcher.ts
+++ b/apps/sim/executor/utils/resolved-secret-matcher.ts
@@ -293,7 +293,8 @@ export function sanitizeResolvedSecretString(
   value: string,
   matcher: ResolvedSecretMatcher,
   maxBytes = MAX_INLINE_MATERIALIZATION_BYTES,
-  onMatch?: (plaintext: string) => void
+  onMatch?: (plaintext: string) => void,
+  options: { preserveLineBreaks?: boolean } = {}
 ): string {
   /**
    * A substitution can leave a literal the previous pass could not act on: an empty replacement can
@@ -302,12 +303,24 @@ export function sanitizeResolvedSecretString(
    * pathological chain from looping, and the throw past it stays the fail-closed backstop callers
    * already handle by dropping the value.
    */
-  let sanitized = substituteResolvedSecrets(value, matcher, maxBytes, onMatch)
+  let sanitized = substituteResolvedSecrets(
+    value,
+    matcher,
+    maxBytes,
+    onMatch,
+    options.preserveLineBreaks
+  )
   for (let pass = 1; containsResolvedSecret(sanitized, matcher); pass += 1) {
     if (pass >= MAX_SETTLE_PASSES) {
       throw new ResolvedSecretMatcherError('Sanitized content still contains an active secret')
     }
-    sanitized = substituteResolvedSecrets(sanitized, matcher, maxBytes, onMatch)
+    sanitized = substituteResolvedSecrets(
+      sanitized,
+      matcher,
+      maxBytes,
+      onMatch,
+      options.preserveLineBreaks
+    )
   }
   return sanitized
 }
@@ -316,7 +329,8 @@ function substituteResolvedSecrets(
   value: string,
   matcher: ResolvedSecretMatcher,
   maxBytes: number,
-  onMatch?: (plaintext: string) => void
+  onMatch?: (plaintext: string) => void,
+  preserveLineBreaks = false
 ): string {
   if (maxBytes < 0) {
     throw new ResolvedSecretMatcherError('Sanitized secret-bearing string exceeds the size limit')
@@ -356,7 +370,21 @@ function substituteResolvedSecrets(
       const slot = emitCursor % windowSize
       if (slotStarts[slot] === emitCursor && slotReplacements[slot] !== undefined) {
         append(value.slice(literalStart, emitCursor))
-        append(slotReplacements[slot] ?? '')
+        const replacement = slotReplacements[slot] ?? ''
+        if (preserveLineBreaks) {
+          const lineReplacement = replacement.replace(/[\r\n]/g, ' ') || ' '
+          const matched = value.slice(emitCursor, slotEnds[slot])
+          let position = 0
+          while (position < matched.length) {
+            append(lineReplacement)
+            const newline = matched.indexOf('\n', position)
+            if (newline < 0) break
+            append(newline > position && matched[newline - 1] === '\r' ? '\r\n' : '\n')
+            position = newline + 1
+          }
+        } else {
+          append(replacement)
+        }
         emitCursor = slotEnds[slot]
         literalStart = emitCursor
       } else {
diff --git a/apps/sim/executor/utils/resolved-secret-trace-registry.ts b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
index e9158202c07..d5408ec0d88 100644
--- a/apps/sim/executor/utils/resolved-secret-trace-registry.ts
+++ b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
@@ -1731,6 +1731,41 @@ export class ResolvedSecretTraceRegistry {
     return importedAll
   }
 
+  /** Imports one item's trusted evidence atomically, leaving this registry unchanged on refusal. */
+  async tryImportProvenance(
+    provenances: Iterable<ResolvedSecretTraceProvenanceV1>,
+    options: ImportResolvedSecretTraceProvenanceOptions & { value?: unknown }
+  ): Promise<boolean> {
+    const staged = new ResolvedSecretTraceRegistry([], this.scope, { staged: true })
+    for (const provenance of provenances) {
+      if (!(await staged.importProvenance(provenance, options)) || !staged.isComplete())
+        return false
+    }
+
+    let entries = [...staged.activeEntries.values()]
+    if (options.value !== undefined) {
+      const filtered = staged.exportProvenanceForValue(options.value)
+      if (!filtered.complete) return false
+      const selected = new Set(
+        filtered.entries.map((entry) =>
+          activeEntryKey({
+            name: entry.name ?? '',
+            plaintext: '',
+            encryptedValue: entry.encryptedValue,
+            anonymous: entry.name === undefined,
+          })
+        )
+      )
+      entries = entries.filter((entry) => selected.has(activeEntryKey(entry)))
+    }
+
+    /** No await separates the capacity check from activation, including across concurrent calls. */
+    if (this.isPermanentlyIncomplete() || this.activeEntryBytesAfter(entries) === undefined)
+      return false
+    for (const entry of entries) this.addActiveEntry(entry, { propagated: true })
+    return true
+  }
+
   /**
    * Imports only provenance whose decrypted plaintext occurs in the exact value crossing this
    * boundary. Staging in a scoped temporary registry prevents a valid but overbroad envelope from
@@ -2578,6 +2613,22 @@ export class ResolvedSecretTraceRegistry {
     if (copied) target.inheritIncompletenessReasonsFrom(this)
   }
 
+  private activeEntryBytesAfter(entries: Iterable<ActiveSecretEntry>): number | undefined {
+    let count = this.activeEntries.size
+    let bytes = this.activeProvenanceEntryBytes
+    for (const entry of entries) {
+      if (this.activeEntries.has(activeEntryKey(entry))) continue
+      bytes += (count === 0 ? 0 : 1) + serializedProvenanceEntryByteSize(toProvenanceEntry(entry))
+      count += 1
+      if (
+        count > MAX_PROVENANCE_ENTRIES ||
+        this.completeProvenanceEnvelopeBytes + bytes > MAX_SERIALIZED_PROVENANCE_BYTES
+      )
+        return undefined
+    }
+    return bytes
+  }
+
   private addActiveEntry(entry: ActiveSecretEntry, options: { propagated?: boolean } = {}): void {
     const key = activeEntryKey(entry)
     const existing = this.activeEntries.get(key)
@@ -2596,22 +2647,14 @@ export class ResolvedSecretTraceRegistry {
       return
     }
 
-    const entryBytes = serializedProvenanceEntryByteSize(toProvenanceEntry(entry))
-    const separatorBytes = this.activeEntries.size === 0 ? 0 : 1
-    if (
-      this.activeEntries.size >= MAX_PROVENANCE_ENTRIES ||
-      this.completeProvenanceEnvelopeBytes +
-        this.activeProvenanceEntryBytes +
-        separatorBytes +
-        entryBytes >
-        MAX_SERIALIZED_PROVENANCE_BYTES
-    ) {
+    const nextEntryBytes = this.activeEntryBytesAfter([entry])
+    if (nextEntryBytes === undefined) {
       this.markIncomplete('provenance-capacity-exceeded')
       return
     }
     this.activeEntries.set(key, entry)
     if (options.propagated) this.propagatedEntryKeys.add(key)
-    this.activeProvenanceEntryBytes += separatorBytes + entryBytes
+    this.activeProvenanceEntryBytes = nextEntryBytes
     this.modelEgressRevision += 1
   }
 
diff --git a/apps/sim/lib/api-key/application/operations.ts b/apps/sim/lib/api-key/application/operations.ts
index 52df9771b9c..f71c81cf02c 100644
--- a/apps/sim/lib/api-key/application/operations.ts
+++ b/apps/sim/lib/api-key/application/operations.ts
@@ -33,6 +33,7 @@ export const apiKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -45,6 +46,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -54,12 +56,14 @@ export const byokKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   listOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.list',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -84,6 +88,7 @@ export const byokKeyOperations = {
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   deleteOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.delete',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -100,6 +105,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/api-key/application/workspace-api-keys.ts b/apps/sim/lib/api-key/application/workspace-api-keys.ts
index 9da3e3188b5..7d30ab9c4fb 100644
--- a/apps/sim/lib/api-key/application/workspace-api-keys.ts
+++ b/apps/sim/lib/api-key/application/workspace-api-keys.ts
@@ -31,12 +31,14 @@ export const workspaceApiKeyOperations = {
     id: 'api_keys.workspace.list',
     minimumRole: 'read',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   rename: defineWorkspaceOperation({
     ...principalPolicy,
     id: 'api_keys.workspace.rename',
     minimumRole: 'admin',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   /** permission-group-exempt: admins must retain the ability to revoke exposed credentials. */
   revoke: defineWorkspaceOperation({
@@ -44,6 +46,7 @@ export const workspaceApiKeyOperations = {
     id: 'api_keys.workspace.revoke',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 const authorizationOptions = { delegation: { audience: 'sim:settings', isWithinScope: () => true } }
diff --git a/apps/sim/lib/api/server/routes/copilot-content-routes.json b/apps/sim/lib/api/server/routes/copilot-content-routes.json
new file mode 100644
index 00000000000..59666a8fdb6
--- /dev/null
+++ b/apps/sim/lib/api/server/routes/copilot-content-routes.json
@@ -0,0 +1,162 @@
+[
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]",
+    "operation": "files.download"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/files/[fileId]/content",
+    "operation": "files.update_content"
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v2/files/[fileId]/content",
+    "operation": "files.update_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/share",
+    "operation": "files.share.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/files/[fileId]/share",
+    "operation": "files.share.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/text",
+    "operation": "files.read_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/[fileId]/versions/[version]/text",
+    "operation": "files.versions.read_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/bulk-download",
+    "operation": "files.download"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/files/search",
+    "operation": "files.search_content"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/connectors/[connectorId]/documents",
+    "operation": "knowledge.connectors.documents.list"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents",
+    "operation": "knowledge.documents.list"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]",
+    "operation": "knowledge.documents.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]",
+    "operation": "knowledge.documents.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks",
+    "operation": "knowledge.chunks.list"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks",
+    "operation": "knowledge.chunks.create"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks/[chunkId]",
+    "operation": "knowledge.chunks.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/documents/[documentId]/chunks/[chunkId]",
+    "operation": "knowledge.chunks.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/knowledge/[knowledgeBaseId]/export",
+    "operation": "knowledge.export"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/knowledge/search",
+    "operation": "knowledge.search"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/query",
+    "operation": "tables.rows.query"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/query/count",
+    "operation": "tables.rows.query"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows",
+    "operation": "tables.rows.list"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/rows",
+    "operation": "tables.rows.create"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]",
+    "operation": "tables.rows.read"
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]",
+    "operation": "tables.rows.update"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/rows/[rowId]/enrichment/[groupId]",
+    "operation": "tables.rows.read"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tables/[tableId]/rows/upsert",
+    "operation": "tables.rows.upsert"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/tools/[toolId]/execute",
+    "operation": "tools.execute"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/workflows/[workflowId]/execute",
+    "operation": "workflows.execute"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]",
+    "operation": "workflows.runs.read"
+  },
+  {
+    "method": "GET",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]/files/[fileId]",
+    "operation": "workflows.download_run_file"
+  },
+  {
+    "method": "POST",
+    "path": "/api/v2/workflows/[workflowId]/runs/[runId]/resume",
+    "operation": "workflows.runs.resume"
+  }
+]
diff --git a/apps/sim/lib/api/server/routes/copilot-refused-routes.json b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
index eacd2e4df6b..2cc89d250fa 100644
--- a/apps/sim/lib/api/server/routes/copilot-refused-routes.json
+++ b/apps/sim/lib/api/server/routes/copilot-refused-routes.json
@@ -229,6 +229,11 @@
     "path": "/api/v2/organizations/[organizationId]/workspaces",
     "operation": "organizations.workspaces.list"
   },
+  {
+    "method": "GET",
+    "path": "/api/v2/tables/[tableId]/exports/[exportId]/download",
+    "operation": "tables.exports.download"
+  },
   {
     "method": "GET",
     "path": "/api/v2/workspaces",
diff --git a/apps/sim/lib/api/server/routes/copilot-request.test.ts b/apps/sim/lib/api/server/routes/copilot-request.test.ts
index ae34e4a1e31..2212c1d8387 100644
--- a/apps/sim/lib/api/server/routes/copilot-request.test.ts
+++ b/apps/sim/lib/api/server/routes/copilot-request.test.ts
@@ -36,6 +36,7 @@ const policy = {
 
 const operation = defineWorkspaceOperation({
   id: 'widgets.read',
+  contentDelivery: 'none',
   capability: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
diff --git a/apps/sim/lib/api/server/routes/copilot-request.ts b/apps/sim/lib/api/server/routes/copilot-request.ts
index 15e841b3e2c..0cb4bc3052a 100644
--- a/apps/sim/lib/api/server/routes/copilot-request.ts
+++ b/apps/sim/lib/api/server/routes/copilot-request.ts
@@ -1,4 +1,5 @@
 import type { DelegatedPrincipal } from '@sim/auth/principal'
+import { noteContentDeliveryOperation } from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
 import {
@@ -48,5 +49,6 @@ export function copilotRequestPrincipal(
   if (!audience) return undefined
   const principal = createCopilotChatPrincipal(invocation, audience)
   markCopilotWorkspaceInvocation(principal)
+  noteContentDeliveryOperation(operation, principal)
   return principal
 }
diff --git a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
index 0d02d41f43a..b29ca9fa233 100644
--- a/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
+++ b/apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts
@@ -11,8 +11,8 @@ const inventory = vi.hoisted(
     [] as Array<{
       method: string
       path: string
-      operation: ApplicationOperation
-      useCase: CopilotRouteUseCase
+      operation: RouteOperation
+      useCase?: CopilotRouteUseCase
     }>
 )
 const built = vi.hoisted(() => new WeakSet<object>())
@@ -20,8 +20,8 @@ const builder = vi.hoisted(
   () =>
     (options: {
       contract: { method: string; path: string }
-      operation: ApplicationOperation
-      useCase: CopilotRouteUseCase
+      operation: RouteOperation
+      useCase?: CopilotRouteUseCase
     }) => {
       inventory.push({
         method: options.contract.method,
@@ -40,7 +40,7 @@ const recordAdmission = vi.hoisted(
   () =>
     async (
       _request: Request,
-      operation: ApplicationOperation,
+      operation: RouteOperation,
       _auth: unknown,
       _rateLimit: unknown,
       useCase?: CopilotRouteUseCase
@@ -71,6 +71,10 @@ import {
 } from '@/lib/api/server/routes/copilot-request'
 import { V2_ROUTES } from '@/lib/api/server/routes/v2-route-table.generated'
 import type { ApplicationOperation } from '@/lib/core/application/operation'
+import type { WorkspaceOperation } from '@/lib/core/application/workspace-operation'
+
+type RouteOperation = ApplicationOperation &
+  Pick<WorkspaceOperation, 'principalKinds' | 'delegatedServices'>
 
 /**
  * Routes Mothership refuses, judged by the rule admission itself runs. The CLI command
@@ -80,8 +84,25 @@ import type { ApplicationOperation } from '@/lib/core/application/operation'
  */
 const REFUSED_ROUTES_FILE = './copilot-refused-routes.json'
 
+/**
+ * Routes Chat may call that return content from a provenance-bearing store. Each is gated per
+ * item, and `content-delivery.integration.ts` drives every one through Chat's real transports: a
+ * route added here without a case there fails that suite. Refresh with `vitest run -u`.
+ */
+const CONTENT_ROUTES_FILE = './copilot-content-routes.json'
+
 const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
 
+/** Whether authorization lets a Chat principal through, not only whether the route mints one. */
+function admitsCopilotPrincipal(operation: RouteOperation): boolean {
+  const kinds: readonly string[] = operation.principalKinds
+  const services: readonly string[] | undefined = operation.delegatedServices
+  return (
+    (kinds.includes('delegated') || kinds.includes('organization_delegated')) &&
+    (!services || services.includes('copilot'))
+  )
+}
+
 /**
  * A raw route (chat, workflow execute and resume) admits inside its handler, so it is
  * invoked once and its admission call recorded, which ends the request before any work.
@@ -112,4 +133,22 @@ it('inventories private operation admission without executing use cases', async
     .map(({ method, path, operation }) => ({ method, path, operation: operation.id }))
   await expect(`${JSON.stringify(refused, null, 2)}\n`).toMatchFileSnapshot(REFUSED_ROUTES_FILE)
   expect(audiences.filter(Boolean).every((audience) => audience?.startsWith('sim:'))).toBe(true)
+
+  /**
+   * Every route Chat may call says whether it returns stored content, so no route reaches Chat's
+   * model by being forgotten: an undeclared one is listed here, and definition refuses it too.
+   */
+  const admitted = inventory.filter(
+    (route, index) => audiences[index] && admitsCopilotPrincipal(route.operation)
+  )
+  expect(
+    admitted
+      .filter((route) => route.operation.contentDelivery === undefined)
+      .map(({ method, path, operation }) => `${method} ${path} (${operation.id})`)
+  ).toEqual([])
+  const sourced = admitted
+    .filter((route) => route.operation.contentDelivery === 'sourced')
+    .map(({ method, path, operation }) => ({ method, path, operation: operation.id }))
+    .sort((a, b) => `${a.path} ${a.method}`.localeCompare(`${b.path} ${b.method}`))
+  await expect(`${JSON.stringify(sourced, null, 2)}\n`).toMatchFileSnapshot(CONTENT_ROUTES_FILE)
 }, 60000)
diff --git a/apps/sim/lib/audit-logs/application/operations.ts b/apps/sim/lib/audit-logs/application/operations.ts
index 2f56b86ce32..2aa79688df7 100644
--- a/apps/sim/lib/audit-logs/application/operations.ts
+++ b/apps/sim/lib/audit-logs/application/operations.ts
@@ -45,6 +45,7 @@ export const auditLogOperations = {
   // permission-group-exempt: the organization audit trail is authorized by organization admin or owner role, a scope no workspace-shaped permission group can name
   list: defineAuditLogOperation({
     id: 'audit_logs.list',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     authority: 'organization_admin',
@@ -55,6 +56,7 @@ export const auditLogOperations = {
   // permission-group-exempt: same organization-admin authority as the list it expands; no group key names the audit trail
   readDetail: defineAuditLogOperation({
     id: 'audit_logs.read_detail',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     authority: 'organization_admin',
@@ -71,6 +73,7 @@ export const copilotAuditLogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -79,6 +82,7 @@ export const copilotAuditLogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/benchmarks/application/access.ts b/apps/sim/lib/benchmarks/application/access.ts
index 8a1f529a1da..2e619d5388b 100644
--- a/apps/sim/lib/benchmarks/application/access.ts
+++ b/apps/sim/lib/benchmarks/application/access.ts
@@ -76,6 +76,7 @@ export function defineAuthorizedBenchmarkUseCase<
 
 const targetOperation = defineOrganizationOperation({
   id: 'benchmarks.target.authorize',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'copilot.use',
   principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/benchmarks/application/operations.ts b/apps/sim/lib/benchmarks/application/operations.ts
index 2225f135b7c..2546e6faa7a 100644
--- a/apps/sim/lib/benchmarks/application/operations.ts
+++ b/apps/sim/lib/benchmarks/application/operations.ts
@@ -102,6 +102,7 @@ export const benchmarkOperations = {
 
 export const benchmarkSourceOperation = defineWorkspaceOperation({
   id: 'benchmarks.source.read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
diff --git a/apps/sim/lib/billing/application/member-usage-limits/operations.ts b/apps/sim/lib/billing/application/member-usage-limits/operations.ts
index b99a9f2e6fc..6f8ee79ef2f 100644
--- a/apps/sim/lib/billing/application/member-usage-limits/operations.ts
+++ b/apps/sim/lib/billing/application/member-usage-limits/operations.ts
@@ -6,6 +6,7 @@ export const memberUsageLimitOperations = {
    */
   read: defineOrganizationOperation({
     id: 'organization_member_usage_limits.read',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -18,6 +19,7 @@ export const memberUsageLimitOperations = {
    */
   update: defineOrganizationOperation({
     id: 'organization_member_usage_limits.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
diff --git a/apps/sim/lib/billing/application/operations.ts b/apps/sim/lib/billing/application/operations.ts
index 9f675b07f32..259c70610df 100644
--- a/apps/sim/lib/billing/application/operations.ts
+++ b/apps/sim/lib/billing/application/operations.ts
@@ -40,6 +40,7 @@ export const billingOperations = {
   // permission-group-exempt: a personal account reading its own plan and balance; permission groups scope a workspace, not the billing account that owns it
   readStatus: defineBillingReadOperation({
     id: 'billing.status.read',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     accountScope: 'personal_self',
@@ -50,6 +51,7 @@ export const billingOperations = {
   // permission-group-exempt: the same personal billing account reading its own usage records; no group key names it
   listLogs: defineBillingReadOperation({
     id: 'billing.logs.list',
+    contentDelivery: 'none',
     oauthScope: 'api:read',
     capability: 'none',
     accountScope: 'personal_self',
@@ -66,6 +68,7 @@ export const copilotBillingOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -74,6 +77,7 @@ export const copilotBillingOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/billing/application/organization-usage/operations.ts b/apps/sim/lib/billing/application/organization-usage/operations.ts
index 5d3ca5f4600..cb089dd3bb1 100644
--- a/apps/sim/lib/billing/application/organization-usage/operations.ts
+++ b/apps/sim/lib/billing/application/organization-usage/operations.ts
@@ -44,6 +44,7 @@ export const organizationUsageOperations = {
    */
   readActivitySummary: defineOrganizationOperation({
     id: 'organization_usage.activity.summary.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -52,6 +53,7 @@ export const organizationUsageOperations = {
    */
   readActivityBreakdown: defineOrganizationOperation({
     id: 'organization_usage.activity.breakdown.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -60,6 +62,7 @@ export const organizationUsageOperations = {
    */
   readOverview: defineOrganizationOperation({
     id: 'organization_usage.overview.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
@@ -68,6 +71,7 @@ export const organizationUsageOperations = {
    */
   readSummary: defineOrganizationOperation({
     id: 'organization_usage.summary.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -76,6 +80,7 @@ export const organizationUsageOperations = {
    */
   readBreakdown: defineOrganizationOperation({
     id: 'organization_usage.breakdown.read',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -84,6 +89,7 @@ export const organizationUsageOperations = {
    */
   listEvents: defineOrganizationOperation({
     id: 'organization_usage.events.list',
+    contentDelivery: 'none',
     capability: 'none',
     ...PUBLIC_READ,
   }),
@@ -92,6 +98,7 @@ export const organizationUsageOperations = {
    */
   exportEvents: defineOrganizationOperation({
     id: 'organization_usage.events.export',
+    contentDelivery: 'none',
     capability: 'none',
     ...BASE,
   }),
diff --git a/apps/sim/lib/catalog/application/operations.ts b/apps/sim/lib/catalog/application/operations.ts
index 4c13c97beca..62713f5e349 100644
--- a/apps/sim/lib/catalog/application/operations.ts
+++ b/apps/sim/lib/catalog/application/operations.ts
@@ -27,6 +27,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -43,6 +44,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -59,6 +61,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -75,6 +78,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -95,6 +99,7 @@ export const catalogOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'knowledge.use',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
diff --git a/apps/sim/lib/changelog/application/availability.ts b/apps/sim/lib/changelog/application/availability.ts
index 211f65dd7f0..69b307ab711 100644
--- a/apps/sim/lib/changelog/application/availability.ts
+++ b/apps/sim/lib/changelog/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/changelog/application/operations.ts b/apps/sim/lib/changelog/application/operations.ts
index efa05caac93..a67e795079d 100644
--- a/apps/sim/lib/changelog/application/operations.ts
+++ b/apps/sim/lib/changelog/application/operations.ts
@@ -12,6 +12,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:read',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.read',
     minimumRole: 'read',
   }),
@@ -19,6 +20,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.publish',
     minimumRole: 'write',
   }),
@@ -26,6 +28,7 @@ export const changelogOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'changelog.update',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/chat-deployments/application/operations.ts b/apps/sim/lib/chat-deployments/application/operations.ts
index 4673eb3023d..f689ad160e5 100644
--- a/apps/sim/lib/chat-deployments/application/operations.ts
+++ b/apps/sim/lib/chat-deployments/application/operations.ts
@@ -54,6 +54,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_LIST_POLICY,
   }),
   replace: defineWorkspaceOperation({
@@ -62,6 +63,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -70,6 +72,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -78,6 +81,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -86,6 +90,7 @@ export const chatDeploymentOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...CHAT_DEPLOYMENT_ADMIN_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/core/application/authorized-workspace-use-case.ts b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
index d0acf45beee..233c51e9d74 100644
--- a/apps/sim/lib/core/application/authorized-workspace-use-case.ts
+++ b/apps/sim/lib/core/application/authorized-workspace-use-case.ts
@@ -1,6 +1,7 @@
 import { type AuditActionType, type AuditResourceTypeValue, recordAudit } from '@sim/audit'
 import type { Principal, PrincipalAuditAttribution } from '@sim/auth/principal'
 import { resolvePrincipalAuditAttribution } from '@sim/auth/principal'
+import { runDeclaredContentOperation } from '@/lib/core/application/content-delivery'
 import type { ApplicationOperation, OperationUseCase } from '@/lib/core/application/operation'
 import {
   authorizeWorkspaceOperation,
@@ -214,27 +215,30 @@ export function defineAuthorizedWorkspaceUseCase<
     async execute(args) {
       const executionContext = await authorizePhase(args)
       const { principal, context, request } = executionContext
-      return runWithOutboundOrganization(context.workspaceOrganizationId, async () => {
-        const result = await withinAuthorizedWorkspaceOperation(() =>
-          definition.execute(executionContext)
-        )
-        const resultContext = { ...executionContext, result }
-        const projectedAudit = definition.projectAudit?.(resultContext)
-        if (projectedAudit !== undefined) {
-          const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
-          if (auditEntries.length > 0) {
-            recordProjectedUseCaseAuditEntries(
-              definition.operation,
-              context.workspaceId,
-              principal,
-              request,
-              auditEntries
-            )
+      return runWithOutboundOrganization(context.workspaceOrganizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          principal,
+          () => withinAuthorizedWorkspaceOperation(() => definition.execute(executionContext)),
+          async (result) => {
+            const resultContext = { ...executionContext, result }
+            const projectedAudit = definition.projectAudit?.(resultContext)
+            if (projectedAudit !== undefined) {
+              const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
+              if (auditEntries.length > 0) {
+                recordProjectedUseCaseAuditEntries(
+                  definition.operation,
+                  context.workspaceId,
+                  principal,
+                  request,
+                  auditEntries
+                )
+              }
+            }
+            await definition.afterSuccess?.(resultContext)
           }
-        }
-        await definition.afterSuccess?.(resultContext)
-        return result
-      })
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/core/application/content-delivery.test.ts b/apps/sim/lib/core/application/content-delivery.test.ts
new file mode 100644
index 00000000000..c0db1b09b00
--- /dev/null
+++ b/apps/sim/lib/core/application/content-delivery.test.ts
@@ -0,0 +1,499 @@
+/**
+ * @vitest-environment node
+ */
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { DelegatedServiceId, Principal } from '@sim/auth/principal'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  admitContent,
+  admitWrittenContent,
+  type ContentDeliveryGate,
+  ContentDeliveryUnaccountedError,
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  mustClassifyContent,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+  observeContentOutsideModel,
+  requireAdmittedContent,
+  runDeclaredContentOperation,
+  trackContentDelivery,
+} from '@/lib/core/application/content-delivery'
+import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+import { PROVENANCE_MAX_ENTRIES } from '@/lib/execution/provenance-limits'
+
+function delegated(serviceId: DelegatedServiceId): Principal {
+  const now = Date.now()
+  return {
+    kind: 'delegated',
+    serviceId,
+    subjectUserId: 'user-1',
+    workspaceId: 'workspace-1',
+    delegationId: 'delegation-1',
+    audience: 'sim:test',
+    issuedAt: new Date(now),
+    expiresAt: new Date(now + 60_000),
+  }
+}
+
+const CHAT = delegated('copilot')
+const EXECUTOR = delegated('executor')
+const SESSION: Principal = { kind: 'session', userId: 'user-1', sessionId: 'session-1' }
+
+function operation(contentDelivery: 'sourced' | 'none') {
+  return defineWorkspaceOperation({
+    id: `test.${contentDelivery}`,
+    contentDelivery,
+    minimumRole: 'read',
+    workspaceApiKey: 'deny',
+    principalKinds: ['delegated'],
+    delegatedServices: ['copilot'],
+    capability: 'none',
+  })
+}
+
+const SOURCED = operation('sourced')
+const NONE = operation('none')
+
+function source(id: string, status: 'clean' | 'unknown' = 'clean'): ContentSource {
+  return {
+    kind: 'workspace-file',
+    id,
+    provenance: status === 'clean' ? { status: 'exact', entries: [] } : { status: 'unknown' },
+    view: 'complete',
+  }
+}
+
+/** Admits clean items and refuses unknown ones, recording every batch it was asked about. */
+function recordingGate() {
+  const batches: string[][] = []
+  const gate: ContentDeliveryGate = {
+    async admit(sources) {
+      batches.push(sources.map((item) => item.id))
+      return sources.map((item) => item.provenance.status !== 'unknown')
+    },
+  }
+  return { gate, batches }
+}
+
+describe('mustClassifyContent', () => {
+  it('refuses Chat with no gate before anything loads', () => {
+    expect(() => mustClassifyContent(CHAT)).toThrow(ContentDeliveryUnobservedError)
+  })
+
+  it('is true for Chat under a gate and false for every other caller, gate or not', () => {
+    const { gate } = recordingGate()
+    expect(observeContentDelivery(gate, () => mustClassifyContent(CHAT))).toBe(true)
+    expect(mustClassifyContent(EXECUTOR)).toBe(false)
+    expect(mustClassifyContent(SESSION)).toBe(false)
+    expect(observeContentDelivery(gate, () => mustClassifyContent(SESSION))).toBe(false)
+  })
+})
+
+describe('admitContent', () => {
+  it('decides each item on its own for Chat', async () => {
+    const { gate, batches } = recordingGate()
+    const items = [source('clean'), source('tainted', 'unknown'), source('also-clean')]
+    const admission = await observeContentDelivery(gate, () => admitContent(CHAT, items))
+    expect(items.map((item) => admission.admits(item))).toEqual([true, false, true])
+    expect(admission.refused.map((item) => item.id)).toEqual(['tainted'])
+    expect(batches).toEqual([['clean', 'tainted', 'also-clean']])
+  })
+
+  it('admits every other caller unread, whatever the items say', async () => {
+    const { gate, batches } = recordingGate()
+    const items = [source('tainted', 'unknown')]
+    for (const principal of [EXECUTOR, SESSION]) {
+      const admission = await observeContentDelivery(gate, () => admitContent(principal, items))
+      expect(admission.admits(items[0])).toBe(true)
+    }
+    expect(batches).toEqual([])
+  })
+
+  it('only accounts for an empty result, even for Chat with no gate', async () => {
+    const record = await trackContentDelivery(async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return admitContent(CHAT, [])
+    })
+    expect(record.result.refused).toEqual([])
+    expect(record.unaccounted).toBe(false)
+  })
+
+  it('refuses Chat items with no gate installed', async () => {
+    await expect(admitContent(CHAT, [source('clean')])).rejects.toThrow(
+      ContentDeliveryUnobservedError
+    )
+  })
+
+  it('refuses items classified inside an operation declared to return none', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(NONE, CHAT, () => admitContent(CHAT, [source('clean')]))
+      )
+    ).rejects.toMatchObject({ name: 'ContentDeliveryUndeclaredError' })
+  })
+})
+
+describe('requireAdmittedContent', () => {
+  it('passes an admitted item and refuses a refused one with a 403 naming no content', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () => requireAdmittedContent(CHAT, source('clean')))
+    ).resolves.toBeUndefined()
+    const refusal = await observeContentDelivery(gate, () =>
+      requireAdmittedContent(CHAT, source('tainted', 'unknown')).catch((error: unknown) => error)
+    )
+    expect(refusal).toBeInstanceOf(ContentRefusedError)
+    expect(refusal).toMatchObject({
+      code: 'forbidden',
+      message: expect.not.stringContaining('tainted'),
+    })
+  })
+})
+
+describe('runDeclaredContentOperation', () => {
+  it('throws for a sourced operation that never accounted, after its effects completed', async () => {
+    const { gate } = recordingGate()
+    const complete = vi.fn(async () => {})
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => 'unclassified', complete)
+      )
+    ).rejects.toThrow(ContentDeliveryUnaccountedError)
+    expect(complete).toHaveBeenCalledWith('unclassified')
+  })
+
+  it('returns a sourced result that accounted, and a none result that had nothing to account', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [source('clean')])
+          return 'classified'
+        })
+      )
+    ).resolves.toBe('classified')
+    await expect(runDeclaredContentOperation(NONE, CHAT, async () => 'metadata')).resolves.toBe(
+      'metadata'
+    )
+  })
+
+  it('runs every other caller unchanged, with no accounting demanded', async () => {
+    const complete = vi.fn(async () => {})
+    await expect(
+      runDeclaredContentOperation(SOURCED, EXECUTOR, async () => 'run output', complete)
+    ).resolves.toBe('run output')
+    expect(complete).toHaveBeenCalledWith('run output')
+  })
+
+  it('answers a committed write whose returned item was refused only after its effects', async () => {
+    const { gate } = recordingGate()
+    const events: string[] = []
+    const refusal = await observeContentDelivery(gate, () =>
+      runDeclaredContentOperation(
+        SOURCED,
+        CHAT,
+        async () => {
+          const admission = await admitWrittenContent(CHAT, [source('written', 'unknown')])
+          events.push(`write returned admitted=${admission.refused.length === 0}`)
+          return 'saved row'
+        },
+        async () => {
+          events.push('audit recorded')
+        }
+      ).catch((error: unknown) => error)
+    )
+    expect(events).toEqual(['write returned admitted=false', 'audit recorded'])
+    expect(refusal).toBeInstanceOf(ContentRefusedError)
+    expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
+  })
+
+  it.each(['workspace-file', 'tool-result'] as const)(
+    'finishes %s effects before reporting a gate failure with its actual completion state',
+    async (kind) => {
+      const failure = new Error('history unavailable')
+      const failing: ContentDeliveryGate = {
+        async admit() {
+          throw failure
+        },
+      }
+      const events: string[] = []
+      const outcome = await observeContentDelivery(failing, () =>
+        runDeclaredContentOperation(
+          SOURCED,
+          CHAT,
+          async () => {
+            const admission = await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            events.push(`withheld=${admission.refused.length}`)
+            return 'saved row'
+          },
+          async () => {
+            events.push('audit recorded')
+          }
+        ).catch((error: unknown) => error)
+      )
+      expect(events).toEqual(['withheld=1', 'audit recorded'])
+      /** Not the gate's error: that would invite a retry of a write that already committed. */
+      expect(outcome).toBeInstanceOf(ContentRefusedError)
+      expect(outcome).toMatchObject({
+        message: expect.stringContaining(
+          kind === 'tool-result' ? 'Tool execution settled' : 'The change was saved'
+        ),
+      })
+      /** The request's transport still sees the failure, to answer it itself (the proxy's 502). */
+      const record = await observeContentDelivery(failing, () =>
+        trackContentDelivery(() =>
+          runDeclaredContentOperation(SOURCED, CHAT, async () => {
+            await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            return 'saved row'
+          }).catch(() => 'answered')
+        )
+      )
+      expect(record.gateFailure).toBe(failure)
+      expect(record.committedWrite).toBe(kind !== 'tool-result')
+      await expect(
+        observeContentDelivery(failing, () =>
+          trackContentDelivery(() =>
+            runDeclaredContentOperation(SOURCED, CHAT, async () => {
+              await admitWrittenContent(CHAT, [{ ...source('written'), kind }])
+            })
+          )
+        )
+      ).rejects.toMatchObject({ gateFailure: failure, committedWrite: kind !== 'tool-result' })
+    }
+  )
+
+  it('does not account for a result whose admission failed and was caught', async () => {
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw new Error('gate down')
+      },
+    }
+    const outcome = await observeContentDelivery(failing, () =>
+      runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await admitContent(CHAT, [source('read')]).catch(() => undefined)
+        return 'content returned anyway'
+      }).catch((error: unknown) => error)
+    )
+    expect(outcome).toBeInstanceOf(ContentDeliveryUnaccountedError)
+  })
+
+  it('does not let a nested use case account for what its enclosing operation returns', async () => {
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    const outcome = await observeContentDelivery(admitAll, () =>
+      runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [source('nested')])
+          return 'nested'
+        })
+        return 'outer content never classified'
+      }).catch((error: unknown) => error)
+    )
+    expect(outcome).toBeInstanceOf(ContentDeliveryUnaccountedError)
+  })
+
+  it('rethrows a gate failure at once when no operation is open to answer with it', async () => {
+    const failure = new Error('history unavailable')
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw failure
+      },
+    }
+    await expect(
+      observeContentDelivery(failing, () => admitWrittenContent(CHAT, [source('written')]))
+    ).rejects.toBe(failure)
+  })
+
+  it('lets a written result through when every returned item was admitted', async () => {
+    const { gate } = recordingGate()
+    await expect(
+      observeContentDelivery(gate, () =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitWrittenContent(CHAT, [source('written')])
+          return 'saved row'
+        })
+      )
+    ).resolves.toBe('saved row')
+  })
+})
+
+describe('trackContentDelivery', () => {
+  it('reports a sourced operation Chat was admitted to whose use case never accounted', async () => {
+    const record = await trackContentDelivery(async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return 'response'
+    })
+    expect(record).toEqual({
+      result: 'response',
+      unaccounted: true,
+      committedWrite: false,
+      admitted: [],
+    })
+  })
+
+  it('does not report a none operation, or a sourced one another caller ran', async () => {
+    for (const [op, principal] of [
+      [NONE, CHAT],
+      [SOURCED, EXECUTOR],
+    ] as const) {
+      const record = await trackContentDelivery(async () => {
+        noteContentDeliveryOperation(op, principal)
+      })
+      expect(record.unaccounted).toBe(false)
+    }
+  })
+
+  it('collects the provenance of admitted items only, through nested use cases', async () => {
+    const { gate } = recordingGate()
+    const entries = {
+      status: 'exact' as const,
+      entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }],
+    }
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(() =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+            await admitContent(CHAT, [
+              { ...source('inner'), provenance: entries },
+              source('refused', 'unknown'),
+            ])
+          })
+          await admitContent(CHAT, [source('outer')])
+        })
+      )
+    )
+    expect(record.unaccounted).toBe(false)
+    expect(record.admitted).toEqual([entries])
+  })
+
+  it('keeps one bounded provenance union when nested deferred pages repeat admitted evidence', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const entries = [
+      { encryptedValue: 'first-ciphertext', sourceUserId: 'user-1' },
+      { encryptedValue: 'second-ciphertext', sourceUserId: 'user-1' },
+    ]
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(() =>
+        runDeclaredContentOperation(SOURCED, CHAT, async () => {
+          await admitContent(CHAT, [])
+          const inRequest = AsyncLocalStorage.snapshot()
+          return () =>
+            inRequest(() =>
+              trackContentDelivery(async () => {
+                await admitContent(
+                  CHAT,
+                  entries.map((entry, index) => ({
+                    ...source(`chunk-${index}`),
+                    provenance: { status: 'exact', entries: [entry] },
+                  }))
+                )
+              })
+            )
+        })
+      )
+    )
+    expect(record.admitted).toEqual([])
+    for (let page = 0; page < 200; page += 1) {
+      const nested = await record.result()
+      expect(nested.admitted).toEqual([{ status: 'exact', entries }])
+    }
+    expect(record.admitted).toEqual([{ status: 'exact', entries }])
+  })
+
+  it('retains unrecorded coverage without retaining every clean or unrecorded source', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(async () => {
+        for (let page = 0; page < 200; page += 1) {
+          await admitContent(CHAT, [
+            source('clean'),
+            { ...source('legacy'), provenance: { status: 'unrecorded' } },
+          ])
+        }
+      })
+    )
+    expect(record.admitted).toEqual([{ status: 'unrecorded' }])
+  })
+
+  it('uses the existing provenance budget for combined delivered evidence', async () => {
+    const gate: ContentDeliveryGate = {
+      async admit(items) {
+        return items.map(() => true)
+      },
+    }
+    const entries = Array.from({ length: PROVENANCE_MAX_ENTRIES }, (_, index) => ({
+      encryptedValue: `ciphertext-${index}`,
+      sourceUserId: 'user-1',
+    }))
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(async () => {
+        await admitContent(CHAT, [{ ...source('first'), provenance: { status: 'exact', entries } }])
+        await admitContent(CHAT, [
+          {
+            ...source('overflow'),
+            provenance: {
+              status: 'exact',
+              entries: [{ encryptedValue: 'one-more', sourceUserId: 'user-1' }],
+            },
+          },
+        ])
+      })
+    )
+    expect(record.admitted).toEqual([{ status: 'unknown' }])
+  })
+
+  it('keeps a nested request’s accounting from satisfying a sibling that never accounted', async () => {
+    const { gate } = recordingGate()
+    const [accounted, unaccounted] = await observeContentDelivery(gate, () =>
+      Promise.all([
+        trackContentDelivery(async () => {
+          noteContentDeliveryOperation(SOURCED, CHAT)
+          await admitContent(CHAT, [source('clean')])
+        }),
+        trackContentDelivery(async () => {
+          noteContentDeliveryOperation(SOURCED, CHAT)
+        }),
+      ])
+    )
+    expect(accounted.unaccounted).toBe(false)
+    expect(unaccounted.unaccounted).toBe(true)
+  })
+})
+
+describe('observeContentDelivery', () => {
+  it('decides by the innermost gate', async () => {
+    const outer = recordingGate()
+    const inner = recordingGate()
+    await observeContentDelivery(outer.gate, () =>
+      observeContentDelivery(inner.gate, () => admitContent(CHAT, [source('clean')]))
+    )
+    expect(inner.batches).toEqual([['clean']])
+    expect(outer.batches).toEqual([])
+  })
+})
+
+describe('observeContentOutsideModel', () => {
+  it('admits every item, tainted ones included, inside a gate that would refuse them', async () => {
+    const { gate, batches } = recordingGate()
+    const tainted = source('tainted', 'unknown')
+    const admission = await observeContentDelivery(gate, () =>
+      observeContentOutsideModel(() => admitContent(CHAT, [tainted]))
+    )
+    expect(admission.admits(tainted)).toBe(true)
+    expect(batches).toEqual([])
+  })
+})
diff --git a/apps/sim/lib/core/application/content-delivery.ts b/apps/sim/lib/core/application/content-delivery.ts
new file mode 100644
index 00000000000..d07902baf2a
--- /dev/null
+++ b/apps/sim/lib/core/application/content-delivery.ts
@@ -0,0 +1,506 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { Principal } from '@sim/auth/principal'
+import type { ApplicationOperation } from '@/lib/core/application/operation'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { mergeDurableSecretProvenanceSources } from '@/lib/execution/provenance-entries'
+
+/**
+ * The secret provenance of one stored item: `exact` names every secret its content can hold,
+ * `unrecorded` is a writer that recorded nothing (audited, otherwise ordinary input), and `unknown`
+ * is taint or a stale binding, which no policy relaxes.
+ */
+export type ContentProvenance = DurableSecretProvenance | { status: 'unrecorded' }
+
+export type ContentSourceKind =
+  | 'workspace-file'
+  | 'execution-file'
+  | 'knowledge-document'
+  | 'knowledge-chunk'
+  | 'table-row'
+  | 'tool-result'
+
+/**
+ * How an item's content leaves the use case. `complete` is text in which any of its secrets may
+ * appear; `derived` is text built from part of it, so only secrets occurring in `value` count;
+ * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links;
+ * `excerpt` is text already cut before admission, so a secret fragment cannot be redacted.
+ */
+export type ContentView = 'complete' | 'opaque' | 'excerpt' | { derived: unknown }
+
+/** One stored item or tool result whose content a use case is about to return. */
+export interface ContentSource {
+  kind: ContentSourceKind
+  /** Canonical id, for attribution and per-item exclusion only. */
+  id: string
+  provenance: ContentProvenance
+  view: ContentView
+}
+
+/**
+ * Decides, per item, whether content may leave through the surface that installed it. A gate never
+ * throws for a refusal: refusing one item must not cost the call the items it admits.
+ */
+export interface ContentDeliveryGate {
+  admit(sources: readonly ContentSource[]): Promise<readonly boolean[]>
+  /**
+   * Redacts text before cutting, or returns `undefined` when it cannot be shown. The current
+   * operation's bounded evidence lets a surface create a redactor only when a cut needs one.
+   */
+  project?(
+    text: string,
+    provenance?: ContentProvenance
+  ): string | undefined | Promise<string | undefined>
+}
+
+/**
+ * Whether a declared operation's result can carry content derived from a provenance-bearing store
+ * (workspace files and their versions, execution files, knowledge documents and chunks, table
+ * rows): bytes, text, excerpts, cells, previews, base64, archives, public links to such content, or
+ * returned matches. `none` is spelled out, as `capability` is, so an operation Chat can reach
+ * cannot reach production without someone deciding.
+ */
+export type ContentDeliveryDeclaration = 'sourced' | 'none'
+
+/** Accounting for one dispatched request or one use-case execution. */
+interface ContentLedger {
+  parent?: ContentLedger
+  /** The declaration of the operation this ledger runs, when it runs one. */
+  declaration?: ContentDeliveryDeclaration
+  /** Chat was admitted to a `sourced` operation while this ledger was open. */
+  sourcedOperationAdmitted: boolean
+  /** A use case accounted for the sources it returns, even when it returned none. */
+  accounted: boolean
+  /** Bounded aggregate of admitted provenance, for a surface that persists the delivered bytes. */
+  admitted: ContentProvenance[]
+  /** A committed write's returned item was refused; the operation answers with a refusal. */
+  withheldAfterWrite?: ContentSourceKind
+  /** The gate itself failed while this ledger was open, whatever the route then answered. */
+  gateFailure?: unknown
+}
+
+const gates = new AsyncLocalStorage<ContentDeliveryGate>()
+const ledgers = new AsyncLocalStorage<ContentLedger>()
+
+const MODEL_UNSAFE_CONTENT_MESSAGES: Record<ContentSourceKind, string> = {
+  'workspace-file': 'File cannot be sent to a model because its secret provenance is unavailable',
+  'execution-file':
+    'Run file cannot be sent to a model because its secret provenance is unavailable',
+  'knowledge-document':
+    'Document cannot be sent to a model because its secret provenance is unavailable',
+  'knowledge-chunk': 'Chunk cannot be sent to a model because its secret provenance is unavailable',
+  'table-row': 'Row cannot be sent to a model because its secret provenance is unavailable',
+  'tool-result':
+    'Tool result cannot be sent to a model because its secret provenance is unavailable',
+}
+
+/**
+ * A gate refused an item. A `403` like any refusal, but its own class, so a caller assembling many
+ * items can leave this one out without mistaking a permission denial for it.
+ */
+export class ContentRefusedError extends OrchestrationError {
+  /** `afterWrite` names a refusal of a write's returned content once the write has committed. */
+  constructor(kind: ContentSourceKind, options: { afterWrite?: boolean } = {}) {
+    super(
+      'forbidden',
+      options.afterWrite
+        ? kind === 'tool-result'
+          ? 'Tool execution settled, but its result could not be returned safely. Do not retry automatically.'
+          : `The change was saved. ${MODEL_UNSAFE_CONTENT_MESSAGES[kind]}, so the result is not shown; do not retry the change.`
+        : MODEL_UNSAFE_CONTENT_MESSAGES[kind]
+    )
+    this.name = 'ContentRefusedError'
+  }
+}
+
+/** Chat reached stored content with no gate to classify it. */
+export class ContentDeliveryUnobservedError extends Error {
+  constructor() {
+    super('Content provenance is unavailable for this read. Retry the read.')
+    this.name = 'ContentDeliveryUnobservedError'
+  }
+}
+
+/** A `sourced` operation completed for Chat without accounting for the content it returned. */
+export class ContentDeliveryUnaccountedError extends Error {
+  constructor(operationId: string) {
+    super(`Operation ${operationId} returned content to Chat without classifying it`)
+    this.name = 'ContentDeliveryUnaccountedError'
+  }
+}
+
+/** Content was classified for Chat inside an operation declared to return none. */
+class ContentDeliveryUndeclaredError extends Error {
+  constructor() {
+    super('Content was delivered to Chat by an operation declared to return none')
+    this.name = 'ContentDeliveryUndeclaredError'
+  }
+}
+
+/** Chat's own principals: the in-workspace delegation and the organization chat delegation. */
+export function isCopilotPrincipal(principal: Principal): boolean {
+  return (
+    (principal.kind === 'delegated' || principal.kind === 'organization_delegated') &&
+    principal.serviceId === 'copilot'
+  )
+}
+
+/** Installs the gate every item reported inside `execute` is decided by; the innermost gate wins. */
+export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: () => T): T {
+  return gates.run(gate, execute)
+}
+
+/**
+ * Text a use case is about to cut (a line window, a clip), redacted first by the surface's gate.
+ * Egress redacts whole secrets only, so a cut through one would leave a fragment it cannot
+ * recognize. Other callers and explicit outside-model reads get the text unchanged.
+ */
+export async function redactBeforeCutting(
+  principal: Principal | undefined,
+  text: string,
+  kind: ContentSourceKind
+): Promise<string> {
+  if (principal && !isCopilotPrincipal(principal)) return text
+  const project = gates.getStore()?.project
+  if (!project) return text
+  const projected = await project(text, ledgers.getStore()?.admitted[0])
+  if (projected === undefined) throw new ContentRefusedError(kind)
+  return projected
+}
+
+/** Admits every item: see {@link observeContentOutsideModel}. */
+const OUTSIDE_MODEL_GATE: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(() => true)
+  },
+}
+
+/**
+ * Reads, for Chat, content that never reaches its model: input to a stored artifact whose
+ * classification the caller derives from every source it read (a transcoded media file), or the
+ * user's own view of a file being edited. Items read inside `execute` are admitted unclassified,
+ * so a tainted source still yields a derived file that carries its taint. Each use names why.
+ */
+export function observeContentOutsideModel<T>(execute: () => T): T {
+  return gates.run(OUTSIDE_MODEL_GATE, execute)
+}
+
+/**
+ * Whether this call must classify what it returns: Chat's own principals, under the gate of the
+ * surface they read through. Chat with no gate is refused here, before anything loads, rather
+ * than handed content no surface classified. Use cases read provenance only when this is true, so
+ * a caller no gate observes — the UI, API keys, MCP, the executor, and app tools Chat runs under an
+ * executor identity, whose results carry their own provenance metadata — issues no extra query
+ * and sees no change.
+ */
+export function mustClassifyContent(principal: Principal): boolean {
+  if (!isCopilotPrincipal(principal)) return false
+  if (!gates.getStore()) throw new ContentDeliveryUnobservedError()
+  return true
+}
+
+/** The per-item verdicts for one call to {@link admitContent}. */
+export class ContentAdmission {
+  private readonly verdicts: ReadonlyMap<ContentSource, boolean>
+
+  constructor(sources: readonly ContentSource[], verdicts: readonly boolean[]) {
+    this.verdicts = new Map(sources.map((source, index) => [source, verdicts[index] === true]))
+  }
+
+  admits(source: ContentSource): boolean {
+    return this.verdicts.get(source) === true
+  }
+
+  get refused(): ContentSource[] {
+    return [...this.verdicts].filter(([, admitted]) => !admitted).map(([source]) => source)
+  }
+}
+
+/**
+ * Accounts for the operation running now and the requests around it. An enclosing operation is
+ * not marked: a nested use case's admission covers what it returned, not what the outer one adds.
+ */
+function markAccounted(): void {
+  const current = ledgers.getStore()
+  if (!current) return
+  current.accounted = true
+  for (let ledger = current.parent; ledger; ledger = ledger.parent) {
+    if (ledger.declaration === undefined) ledger.accounted = true
+  }
+}
+
+function mergeContentProvenance(
+  values: Iterable<ContentProvenance>
+): ContentProvenance | undefined {
+  let admitted = false
+  let unrecorded = false
+  const merged = mergeDurableSecretProvenanceSources(
+    (function* () {
+      for (const value of values) {
+        admitted = true
+        if (value.status === 'unrecorded') unrecorded = true
+        else yield value
+      }
+    })()
+  )
+  if (!admitted) return undefined
+  if (unrecorded && merged.status === 'exact' && merged.entries.length === 0) {
+    return { status: 'unrecorded' }
+  }
+  return merged
+}
+
+/** A committed write returned an item of `kind` its gate refused or could not decide. */
+function withholdAfterWrite(kind: ContentSourceKind): void {
+  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
+    if (ledger.withheldAfterWrite === undefined || ledger.withheldAfterWrite === 'tool-result') {
+      ledger.withheldAfterWrite = kind
+    }
+  }
+}
+
+/**
+ * Classifies every item a use case is about to return, before its content loads. Call it once per
+ * result, with every contributing item, including an empty list: that call is the use case's
+ * promise to the operation's `sourced` declaration that nothing else in the result is sourced.
+ *
+ * Chat with no gate installed is refused (fail closed); every other caller is admitted unread. An
+ * empty list loads nothing, so it only accounts.
+ */
+export async function admitContent(
+  principal: Principal,
+  sources: readonly ContentSource[]
+): Promise<ContentAdmission> {
+  if (
+    sources.length > 0 &&
+    isCopilotPrincipal(principal) &&
+    ledgers.getStore()?.declaration === 'none'
+  ) {
+    throw new ContentDeliveryUndeclaredError()
+  }
+  /** Accounting follows a decision: a caller that catches a failure has classified nothing. */
+  if (sources.length === 0 || !mustClassifyContent(principal)) {
+    markAccounted()
+    return new ContentAdmission(
+      sources,
+      sources.map(() => true)
+    )
+  }
+  const gate = gates.getStore()
+  if (!gate) throw new ContentDeliveryUnobservedError()
+  const ledger = ledgers.getStore()
+  let verdicts: readonly boolean[]
+  try {
+    verdicts = await gate.admit(sources)
+  } catch (error) {
+    /** Kept for the transport: a route maps the error to its own response and hides the cause. */
+    for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
+      current.gateFailure ??= error
+    }
+    throw error
+  }
+  markAccounted()
+  if (ledger) {
+    const batch = mergeContentProvenance(
+      (function* () {
+        for (let index = 0; index < sources.length; index++) {
+          if (verdicts[index]) yield sources[index].provenance
+        }
+      })()
+    )
+    if (batch) {
+      for (let current: ContentLedger | undefined = ledger; current; current = current.parent) {
+        const previous = current.admitted[0]
+        const aggregate = previous ? mergeContentProvenance([previous, batch]) : batch
+        if (aggregate) current.admitted.splice(0, current.admitted.length, aggregate)
+      }
+    }
+  }
+  return new ContentAdmission(sources, verdicts)
+}
+
+/**
+ * Admits what a write returns after it committed. A refused item does not end the call here, so
+ * the operation still records its audit and signals its change; it then answers with a refusal
+ * naming the saved change instead of a result carrying content its gate refused.
+ */
+export async function admitWrittenContent(
+  principal: Principal,
+  sources: readonly ContentSource[]
+): Promise<ContentAdmission> {
+  let admission: ContentAdmission
+  try {
+    admission = await admitContent(principal, sources)
+  } catch (error) {
+    /**
+     * A gate that cannot decide (its record could not be written) must not undo the write's audit
+     * and effects either: every item is withheld, and the operation answers "saved, not shown".
+     * A transport that must answer the failure itself reads it from the request's ledger.
+     */
+    const [first] = sources
+    if (!ledgers.getStore() || !first) throw error
+    /** The result is decided after all: withheld whole, as saved-not-shown. */
+    markAccounted()
+    withholdAfterWrite(first.kind)
+    return new ContentAdmission(
+      sources,
+      sources.map(() => false)
+    )
+  }
+  const refused = admission.refused[0]
+  if (refused) withholdAfterWrite(refused.kind)
+  return admission
+}
+
+/**
+ * Admits each of many items on its own and returns the admitted ones, in order. `classify` maps
+ * the items to their sources, one per item and batched; it runs only when this call must
+ * classify, so any other caller pays no provenance read. An item it cannot vouch for is `unknown`.
+ */
+export async function admitEach<T>(
+  principal: Principal,
+  items: readonly T[],
+  classify: (items: readonly T[]) => Promise<readonly ContentSource[]>,
+  options: { written?: ContentSourceKind } = {}
+): Promise<T[]> {
+  if (items.length === 0 || !mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return [...items]
+  }
+  if (!options.written) {
+    const sources = await classify(items)
+    const admission = await admitContent(principal, sources)
+    return items.filter((_, index) => admission.admits(sources[index]))
+  }
+  /** A committed write whose items cannot even be classified is saved, then withheld whole. */
+  let sources: readonly ContentSource[]
+  try {
+    sources = await classify(items)
+  } catch (error) {
+    if (!ledgers.getStore()) throw error
+    markAccounted()
+    withholdAfterWrite(options.written)
+    return []
+  }
+  const admission = await admitWrittenContent(principal, sources)
+  return items.filter((_, index) => admission.admits(sources[index]))
+}
+
+/**
+ * The single-item form: a refused item ends the call with a `403` before its content loads, with a
+ * constant message that names no content.
+ */
+export async function requireAdmittedContent(
+  principal: Principal,
+  source: ContentSource
+): Promise<void> {
+  const admission = await admitContent(principal, [source])
+  if (!admission.admits(source)) throw new ContentRefusedError(source.kind)
+}
+
+/** The gate failed during a dispatched request, which may have committed a write first. */
+export class ContentGateFailure extends Error {
+  constructor(
+    readonly gateFailure: unknown,
+    readonly committedWrite: boolean
+  ) {
+    super('The content gate failed during the request', { cause: gateFailure })
+    this.name = 'ContentGateFailure'
+  }
+}
+
+/** What one dispatched request delivered, as the transport that dispatched it needs to know. */
+export interface ContentDeliveryRecord<T> {
+  result: T
+  /** Chat ran a `sourced` operation whose use case never accounted for its content. */
+  unaccounted: boolean
+  /** The gate failed to decide during the request; see {@link ContentLedger.gateFailure}. */
+  gateFailure?: unknown
+  /** A write committed, then its returned content was withheld: the change happened. */
+  committedWrite: boolean
+  /** Bounded aggregate of admitted provenance, updated in place during deferred delivery. */
+  admitted: readonly ContentProvenance[]
+}
+
+/**
+ * Dispatches one request under its own ledger. A transport refuses a successful response whose
+ * record is `unaccounted`, whatever the HTTP method, so a route that forgot to classify its content
+ * fails closed instead of passing it through.
+ */
+export async function trackContentDelivery<T>(
+  execute: () => Promise<T>
+): Promise<ContentDeliveryRecord<T>> {
+  const ledger: ContentLedger = {
+    parent: ledgers.getStore(),
+    sourcedOperationAdmitted: false,
+    accounted: false,
+    admitted: [],
+  }
+  let result: T
+  try {
+    result = await ledgers.run(ledger, execute)
+  } catch (error) {
+    /** The request threw because its gate failed; its transport answers that, not the error. */
+    if (ledger.gateFailure === undefined) throw error
+    throw new ContentGateFailure(
+      ledger.gateFailure,
+      ledger.withheldAfterWrite !== undefined && ledger.withheldAfterWrite !== 'tool-result'
+    )
+  }
+  return {
+    result,
+    unaccounted: ledger.sourcedOperationAdmitted && !ledger.accounted,
+    committedWrite:
+      ledger.withheldAfterWrite !== undefined && ledger.withheldAfterWrite !== 'tool-result',
+    admitted: ledger.admitted,
+    ...(ledger.gateFailure === undefined ? {} : { gateFailure: ledger.gateFailure }),
+  }
+}
+
+/** Route admission records that Chat was admitted to an operation, in the request's ledger. */
+export function noteContentDeliveryOperation(
+  operation: ApplicationOperation,
+  principal: Principal
+): void {
+  if (!isCopilotPrincipal(principal) || operation.contentDelivery !== 'sourced') return
+  for (let ledger = ledgers.getStore(); ledger; ledger = ledger.parent) {
+    ledger.sourcedOperationAdmitted = true
+  }
+}
+
+/**
+ * Runs one use case for Chat under its operation's declaration: `execute` is the business phase,
+ * `complete` its audit and after-success effects. A `sourced` operation that returns without
+ * accounting throws rather than hand its content to a model unclassified, and one whose committed
+ * write returned refused content answers with that refusal once its effects are complete. This
+ * holds on every Chat path, transported or called in-process by a tool.
+ */
+export async function runDeclaredContentOperation<T>(
+  operation: ApplicationOperation,
+  principal: Principal,
+  execute: () => Promise<T>,
+  complete?: (result: T) => Promise<void>
+): Promise<T> {
+  if (!isCopilotPrincipal(principal)) {
+    const result = await execute()
+    await complete?.(result)
+    return result
+  }
+  noteContentDeliveryOperation(operation, principal)
+  const ledger: ContentLedger = {
+    parent: ledgers.getStore(),
+    declaration: operation.contentDelivery,
+    sourcedOperationAdmitted: false,
+    accounted: false,
+    admitted: [],
+  }
+  const result = await ledgers.run(ledger, execute)
+  await complete?.(result)
+  if (operation.contentDelivery === 'sourced' && !ledger.accounted) {
+    throw new ContentDeliveryUnaccountedError(operation.id)
+  }
+  if (ledger.withheldAfterWrite) {
+    throw new ContentRefusedError(ledger.withheldAfterWrite, { afterWrite: true })
+  }
+  return result
+}
diff --git a/apps/sim/lib/core/application/index.ts b/apps/sim/lib/core/application/index.ts
index 48215ea637a..5b91b1fd8f2 100644
--- a/apps/sim/lib/core/application/index.ts
+++ b/apps/sim/lib/core/application/index.ts
@@ -61,3 +61,26 @@ export {
   type WorkspaceOperation,
 } from '@/lib/core/application/workspace-operation'
 export { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+export {
+  admitContent,
+  admitEach,
+  admitWrittenContent,
+  type ContentDeliveryDeclaration,
+  type ContentDeliveryGate,
+  ContentDeliveryUnobservedError,
+  ContentGateFailure,
+  type ContentProvenance,
+  ContentRefusedError,
+  type ContentSource,
+  type ContentSourceKind,
+  type ContentView,
+  isCopilotPrincipal,
+  mustClassifyContent,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+  observeContentOutsideModel,
+  redactBeforeCutting,
+  requireAdmittedContent,
+  runDeclaredContentOperation,
+  trackContentDelivery,
+} from './content-delivery'
diff --git a/apps/sim/lib/core/application/operation.ts b/apps/sim/lib/core/application/operation.ts
index ba2721ca1ae..a35b3522159 100644
--- a/apps/sim/lib/core/application/operation.ts
+++ b/apps/sim/lib/core/application/operation.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { OAuthApiScope } from '@/lib/auth/oauth-provider'
+import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
 import { requireOAuthOperationScope } from '@/lib/core/application/oauth-authorization'
 import type { OrchestrationRequestContext } from '@/lib/core/orchestration/types'
 import {
@@ -68,6 +69,12 @@ export interface ApplicationOperation<Id extends string = string> {
    * and `check:permission-group-enforcement` keeps reading the source.
    */
   readonly capability: OperationDeclarableCapability | 'none'
+  /**
+   * Whether the result can carry content derived from a provenance-bearing store. Required on
+   * every workspace operation Chat can reach (see {@link ContentDeliveryDeclaration}); a `sourced`
+   * operation's use case classifies each item through `admitContent` before returning it to Chat.
+   */
+  readonly contentDelivery?: ContentDeliveryDeclaration
 }
 
 export type OAuthOperationPolicy<Kinds extends readonly string[]> =
@@ -242,3 +249,27 @@ export interface OperationUseCase<O extends ApplicationOperation, I, R> {
     request?: OrchestrationRequestContext
   }): Promise<void>
 }
+
+/**
+ * An operation Chat can reach says whether it returns stored content; one it cannot reach says
+ * nothing, so the field always means a reviewed answer. Test fixtures escape type-checking, so
+ * this is enforced where operations are minted too.
+ */
+export function assertContentDeliveryDeclaration(
+  operation: ApplicationOperation,
+  delegatedServices: readonly string[]
+): void {
+  const admitsCopilot = delegatedServices.includes('copilot')
+  if (
+    admitsCopilot &&
+    operation.contentDelivery !== 'sourced' &&
+    operation.contentDelivery !== 'none'
+  ) {
+    throw new Error(
+      `Operation ${operation.id} admits Copilot but does not declare contentDelivery; name 'sourced' or 'none'`
+    )
+  }
+  if (!admitsCopilot && operation.contentDelivery !== undefined) {
+    throw new Error(`Operation ${operation.id} declares contentDelivery without admitting Copilot`)
+  }
+}
diff --git a/apps/sim/lib/core/application/organization-authorization.test.ts b/apps/sim/lib/core/application/organization-authorization.test.ts
index 019c963a649..4a727ea8763 100644
--- a/apps/sim/lib/core/application/organization-authorization.test.ts
+++ b/apps/sim/lib/core/application/organization-authorization.test.ts
@@ -21,6 +21,7 @@ const mocks = {
 const principal = createSessionPrincipal({ userId: 'member', sessionId: 'session' })
 const operation = defineOrganizationOperation({
   id: 'search.read',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
   oauthScope: 'api:read',
diff --git a/apps/sim/lib/core/application/organization-operation.ts b/apps/sim/lib/core/application/organization-operation.ts
index 8f2cb7695c6..b359f5fb192 100644
--- a/apps/sim/lib/core/application/organization-operation.ts
+++ b/apps/sim/lib/core/application/organization-operation.ts
@@ -1,6 +1,7 @@
 import type { OrganizationDelegatedPrincipal, Principal } from '@sim/auth/principal'
 import type { ApplicationOperation } from '@/lib/core/application/operation'
 import {
+  assertContentDeliveryDeclaration,
   assertOperationCapability,
   assertOperationOAuthPolicy,
 } from '@/lib/core/application/operation'
@@ -44,6 +45,7 @@ export function defineOrganizationOperation<const O extends OrganizationOperatio
   }
   if (operation.delegatedServices) Object.freeze(operation.delegatedServices)
   assertOperationOAuthPolicy(operation)
+  assertContentDeliveryDeclaration(operation, operation.delegatedServices ?? [])
   Object.freeze(operation.principalKinds)
   return Object.freeze(operation)
 }
diff --git a/apps/sim/lib/core/application/workspace-authorization.test.ts b/apps/sim/lib/core/application/workspace-authorization.test.ts
index a37da95e05b..0a906477d2e 100644
--- a/apps/sim/lib/core/application/workspace-authorization.test.ts
+++ b/apps/sim/lib/core/application/workspace-authorization.test.ts
@@ -262,6 +262,7 @@ const capabilityOperation = defineWorkspaceOperation({
 
 const copilotCapabilityOperation = defineWorkspaceOperation({
   id: 'test.copilot-capability-read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
diff --git a/apps/sim/lib/core/application/workspace-operation.test.ts b/apps/sim/lib/core/application/workspace-operation.test.ts
index c766eca2212..46a8e6733c8 100644
--- a/apps/sim/lib/core/application/workspace-operation.test.ts
+++ b/apps/sim/lib/core/application/workspace-operation.test.ts
@@ -6,6 +6,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
   it('preserves and freezes an explicit delegated service allowlist', () => {
     const operation = defineWorkspaceOperation({
       id: 'test.read',
+      contentDelivery: 'none',
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
@@ -33,6 +34,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
     expect(() =>
       defineWorkspaceOperation({
         id: 'test.unused_service_policy',
+        contentDelivery: 'none',
         minimumRole: 'read',
         workspaceApiKey: 'deny',
         principalKinds: ['session'],
@@ -46,6 +48,7 @@ describe('defineWorkspaceOperation delegated service policy', () => {
     expect(() =>
       defineWorkspaceOperation({
         id: 'test.duplicate_service_policy',
+        contentDelivery: 'none',
         minimumRole: 'read',
         workspaceApiKey: 'deny',
         principalKinds: ['delegated'],
diff --git a/apps/sim/lib/core/application/workspace-operation.ts b/apps/sim/lib/core/application/workspace-operation.ts
index 984bac44ddc..037c5d90025 100644
--- a/apps/sim/lib/core/application/workspace-operation.ts
+++ b/apps/sim/lib/core/application/workspace-operation.ts
@@ -1,11 +1,13 @@
 import type { DelegatedPrincipal, DelegatedServiceId, Principal } from '@sim/auth/principal'
 import type { PermissionType } from '@sim/platform-authz/workspace'
+import type { ContentDeliveryDeclaration } from '@/lib/core/application/content-delivery'
 import type {
   ApplicationOperation,
   OAuthOperationPolicy,
   PrincipalKind,
 } from '@/lib/core/application/operation'
 import {
+  assertContentDeliveryDeclaration,
   assertOperationCapability,
   assertOperationOAuthPolicy,
 } from '@/lib/core/application/operation'
@@ -69,6 +71,19 @@ type DelegatedPrincipalConsistency<
     }
   : { readonly delegatedServices?: never }
 
+/**
+ * Chat delivers whatever a Copilot-admitted operation returns to its model, so each one says
+ * whether that can be stored content; no other operation may claim to.
+ */
+type ContentDeliveryConsistency<
+  PrincipalKinds extends readonly PrincipalKind[],
+  DelegatedServices extends readonly DelegatedServiceId[],
+> = 'delegated' extends PrincipalKinds[number]
+  ? 'copilot' extends DelegatedServices[number]
+    ? { readonly contentDelivery: ContentDeliveryDeclaration }
+    : { readonly contentDelivery?: never }
+  : { readonly contentDelivery?: never }
+
 type ResourcePolicyOperationConsistency<Binding extends ResourcePolicyBinding | undefined> =
   Binding extends ResourcePolicyBinding
     ? { readonly resourcePolicy: Binding }
@@ -85,6 +100,7 @@ export function defineWorkspaceOperation<
     OAuthOperationPolicy<PrincipalKinds> &
     WorkspaceApiKeyPrincipalConsistency<Role, PrincipalKinds> &
     DelegatedPrincipalConsistency<PrincipalKinds, DelegatedServices> &
+    ContentDeliveryConsistency<PrincipalKinds, DelegatedServices> &
     ResourcePolicyOperationConsistency<ResourcePolicy>
 ): WorkspaceOperation<Id, Role, PrincipalKinds, DelegatedServices> &
   OAuthOperationPolicy<PrincipalKinds> &
@@ -120,6 +136,8 @@ export function defineWorkspaceOperation<
 
   if (operation.resourcePolicy) requireResourcePolicyBinding(operation.resourcePolicy)
 
+  assertContentDeliveryDeclaration(operation, delegatedServices)
+
   /**
    * `capability` is required, so refusing an absent one reads as unreachable.
    * It is not. `apps/sim/tsconfig.json` excludes test files from type-checking,
diff --git a/apps/sim/lib/credential-groups/application/operations.ts b/apps/sim/lib/credential-groups/application/operations.ts
index c3c6e40c01b..a6db72f9f9e 100644
--- a/apps/sim/lib/credential-groups/application/operations.ts
+++ b/apps/sim/lib/credential-groups/application/operations.ts
@@ -12,6 +12,7 @@ export const credentialGroupOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/credential-groups/application/organization-access.ts b/apps/sim/lib/credential-groups/application/organization-access.ts
index f56e84e9952..f05d749ee24 100644
--- a/apps/sim/lib/credential-groups/application/organization-access.ts
+++ b/apps/sim/lib/credential-groups/application/organization-access.ts
@@ -27,6 +27,7 @@ import {
 export const organizationAccountAccessOperations = {
   read: defineOrganizationOperation({
     id: 'organization_accounts.workspace_access.read',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -35,6 +36,7 @@ export const organizationAccountAccessOperations = {
   }),
   update: defineOrganizationOperation({
     id: 'organization_accounts.workspace_access.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credential-groups/application/organization-account-management.ts b/apps/sim/lib/credential-groups/application/organization-account-management.ts
index a091e03c448..cb3ea051659 100644
--- a/apps/sim/lib/credential-groups/application/organization-account-management.ts
+++ b/apps/sim/lib/credential-groups/application/organization-account-management.ts
@@ -25,6 +25,7 @@ import { evictMcpServerConnections } from '@/lib/mcp/connection-pool'
 export const organizationAccountManagementOperations = {
   people: defineOrganizationOperation({
     id: 'organization_accounts.people.list',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -33,6 +34,7 @@ export const organizationAccountManagementOperations = {
   }),
   invite: defineOrganizationOperation({
     id: 'organization_accounts.people.invite',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -41,6 +43,7 @@ export const organizationAccountManagementOperations = {
   }),
   resend: defineOrganizationOperation({
     id: 'organization_accounts.people.resend',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -49,6 +52,7 @@ export const organizationAccountManagementOperations = {
   }),
   revoke: defineOrganizationOperation({
     id: 'organization_accounts.people.revoke',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -57,6 +61,7 @@ export const organizationAccountManagementOperations = {
   }),
   addMcp: defineOrganizationOperation({
     id: 'organization_accounts.mcp.add',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -65,6 +70,7 @@ export const organizationAccountManagementOperations = {
   }),
   removeMcp: defineOrganizationOperation({
     id: 'organization_accounts.mcp.remove',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credential-groups/application/organization-accounts.ts b/apps/sim/lib/credential-groups/application/organization-accounts.ts
index 3cfe7c5e6e0..5158f45ba45 100644
--- a/apps/sim/lib/credential-groups/application/organization-accounts.ts
+++ b/apps/sim/lib/credential-groups/application/organization-accounts.ts
@@ -52,6 +52,7 @@ import { isKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availab
 export const organizationAccountOperations = {
   read: defineOrganizationOperation({
     id: 'organization_accounts.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -60,6 +61,7 @@ export const organizationAccountOperations = {
   }),
   ensure: defineOrganizationOperation({
     id: 'organization_accounts.ensure',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -68,6 +70,7 @@ export const organizationAccountOperations = {
   }),
   update: defineOrganizationOperation({
     id: 'organization_accounts.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -76,6 +79,7 @@ export const organizationAccountOperations = {
   }),
   connect: defineOrganizationOperation({
     id: 'organization_accounts.connect',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/credentials/application/operations.ts b/apps/sim/lib/credentials/application/operations.ts
index 566e5534e1e..b1bb906658b 100644
--- a/apps/sim/lib/credentials/application/operations.ts
+++ b/apps/sim/lib/credentials/application/operations.ts
@@ -44,6 +44,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'member'
@@ -61,6 +62,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   authorizePersonal: defineWorkspaceOperation({
@@ -69,6 +71,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   listInternal: defineWorkspaceOperation({
@@ -84,6 +87,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -99,6 +103,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
@@ -125,6 +130,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -133,6 +139,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -142,6 +149,7 @@ export const credentialOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   read: defineCredentialOperation(
@@ -168,6 +176,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -179,6 +188,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -196,6 +206,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     ...HUMAN_AND_COPILOT_PRINCIPALS,
   }),
   upsertMember: defineCredentialOperation(
@@ -205,6 +216,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -216,6 +228,7 @@ export const credentialOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'integrations.manage',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPALS,
     }),
     'admin'
@@ -239,6 +252,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'integrations.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
     resourcePolicy: {
@@ -251,6 +265,7 @@ export const credentialOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
     resourcePolicy: {
diff --git a/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts b/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
index 2fc9b72a254..124427d6104 100644
--- a/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
+++ b/apps/sim/lib/credentials/application/resolve-organization-personal-token.ts
@@ -23,6 +23,7 @@ import { livePolicyFor, loadLiveSearchPolicies } from '@/lib/sim-search/live/pol
 /** Search's organization delegation can use only the member's currently available personal grant. */
 export const organizationPersonalCredentialOperation = defineOrganizationOperation({
   id: 'credentials.organization.personal.use',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['organization_delegated'],
   delegatedServices: ['copilot'],
@@ -132,6 +133,7 @@ export const resolveOrganizationPersonalToken = {
 
 export const organizationPersonalConnectionOperation = defineOrganizationOperation({
   id: 'credentials.organization.personal.prepareConnection',
+  contentDelivery: 'none',
   minimumRole: 'member',
   principalKinds: ['organization_delegated'],
   delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/custom-tools/application/operations.ts b/apps/sim/lib/custom-tools/application/operations.ts
index d00ab6124bc..c6a238f0694 100644
--- a/apps/sim/lib/custom-tools/application/operations.ts
+++ b/apps/sim/lib/custom-tools/application/operations.ts
@@ -28,6 +28,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listAvailable: defineWorkspaceOperation({
@@ -36,6 +37,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -44,6 +46,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   readAvailableByIdOrTitle: defineWorkspaceOperation({
@@ -51,6 +54,7 @@ export const customToolOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot', 'executor'],
   }),
@@ -60,6 +64,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -68,6 +73,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -76,6 +82,7 @@ export const customToolOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'custom_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/dashboards/application/availability.ts b/apps/sim/lib/dashboards/application/availability.ts
index 758dfeafbc9..d5ecc8008a3 100644
--- a/apps/sim/lib/dashboards/application/availability.ts
+++ b/apps/sim/lib/dashboards/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/dashboards/application/operations.ts b/apps/sim/lib/dashboards/application/operations.ts
index c66a54ccd43..d9d697e3acd 100644
--- a/apps/sim/lib/dashboards/application/operations.ts
+++ b/apps/sim/lib/dashboards/application/operations.ts
@@ -11,12 +11,14 @@ export const dashboardOperations = {
   read: defineWorkspaceOperation({
     ...policy,
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'dashboards.read',
     minimumRole: 'read',
   }),
   save: defineWorkspaceOperation({
     ...policy,
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'dashboards.save',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/data-drains/application/operations.ts b/apps/sim/lib/data-drains/application/operations.ts
index dd21c6c3848..4c5c62c2f5f 100644
--- a/apps/sim/lib/data-drains/application/operations.ts
+++ b/apps/sim/lib/data-drains/application/operations.ts
@@ -13,48 +13,56 @@ export const dataDrainOperations = Object.freeze({
   // permission-group-exempt: organization administrators govern organization-wide exports.
   list: defineOrganizationOperation({
     id: 'organization.data_drains.list',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   get: defineOrganizationOperation({
     id: 'organization.data_drains.get',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   create: defineOrganizationOperation({
     id: 'organization.data_drains.create',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   update: defineOrganizationOperation({
     id: 'organization.data_drains.update',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   delete: defineOrganizationOperation({
     id: 'organization.data_drains.delete',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   test: defineOrganizationOperation({
     id: 'organization.data_drains.test',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   run: defineOrganizationOperation({
     id: 'organization.data_drains.run',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
   // permission-group-exempt: organization administrators govern organization-wide exports.
   runs: defineOrganizationOperation({
     id: 'organization.data_drains.runs',
+    contentDelivery: 'none',
     ...policy,
     capability: 'none',
   }),
diff --git a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
index 59d8ef72e4e..49c4c19d9f3 100644
--- a/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance-telemetry.ts
@@ -9,7 +9,12 @@ import { createLogger } from '@sim/logger'
 
 const persistenceLogger = createLogger('DurableSecretProvenancePersistence')
 
-export type DurableSecretProvenanceSurface = 'memory' | 'table-row' | 'knowledge' | 'workspace-file'
+export type DurableSecretProvenanceSurface =
+  | 'memory'
+  | 'table-row'
+  | 'knowledge'
+  | 'workspace-file'
+  | 'tool-result'
 
 export type DurableSecretProvenanceWriteCause =
   | 'source-provenance-unknown'
@@ -35,6 +40,11 @@ export type DurableSecretProvenanceRefusalCause =
   | 'workspace-file-provenance-unavailable'
   | 'workspace-file-opaque-secret-content'
   | 'workspace-file-registry-unavailable'
+  | 'table-row-provenance-unavailable'
+  | 'table-row-opaque-secret-content'
+  | 'knowledge-opaque-secret-content'
+  | 'content-registry-unavailable'
+  | 'tool-result-provenance-unavailable'
 
 export interface DurableSecretProvenanceRefusalReport {
   surface: DurableSecretProvenanceSurface
diff --git a/apps/sim/lib/execution/durable-secret-provenance.ts b/apps/sim/lib/execution/durable-secret-provenance.ts
index 980c666298f..8aa351aaaa5 100644
--- a/apps/sim/lib/execution/durable-secret-provenance.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance.ts
@@ -5,8 +5,10 @@ import {
   isPrivateSecretProvenanceBundleV1,
   type PrivateSecretProvenanceBundleV1,
 } from '@/lib/execution/model-input-provenance'
-import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
-import { PROVENANCE_MAX_SERIALIZED_BYTES } from '@/lib/execution/provenance-limits'
+import {
+  mergeDurableSecretProvenanceSources,
+  normalizeDurableSecretProvenanceBindings,
+} from '@/lib/execution/provenance-entries'
 import {
   type ResolvedSecretTraceProvenanceV1,
   ResolvedSecretTraceRegistry,
@@ -32,59 +34,6 @@ export function normalizeDurableSecretProvenanceEntries(
   return Array.isArray(value) ? normalizeDurableSecretProvenanceBindings(value) : undefined
 }
 
-function normalizeDurableSecretProvenanceBindings(
-  candidates: Iterable<unknown>
-): DurableSecretProvenanceEntry[] | undefined {
-  const entries = new Map<string, DurableSecretProvenanceEntry>()
-  const budget = new SecretProvenanceBudget()
-  for (const candidate of candidates) {
-    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) return undefined
-    const record = candidate as Record<string, unknown>
-    if (
-      typeof record.encryptedValue !== 'string' ||
-      record.encryptedValue.length === 0 ||
-      (record.name !== undefined && typeof record.name !== 'string') ||
-      (record.sourceUserId !== undefined && typeof record.sourceUserId !== 'string') ||
-      (record.sourceWorkspaceId !== undefined && typeof record.sourceWorkspaceId !== 'string') ||
-      (record.sourceValueHash !== undefined && typeof record.sourceValueHash !== 'string') ||
-      (record.sourceWorkspaceId !== undefined && record.sourceUserId === undefined)
-    ) {
-      return undefined
-    }
-    const entry: DurableSecretProvenanceEntry = {
-      encryptedValue: record.encryptedValue,
-      ...(typeof record.name === 'string' && record.name.length > 0 ? { name: record.name } : {}),
-      ...(typeof record.sourceUserId === 'string' && record.sourceUserId.length > 0
-        ? { sourceUserId: record.sourceUserId }
-        : {}),
-      ...(typeof record.sourceWorkspaceId === 'string' && record.sourceWorkspaceId.length > 0
-        ? { sourceWorkspaceId: record.sourceWorkspaceId }
-        : {}),
-      ...(typeof record.sourceValueHash === 'string' && record.sourceValueHash.length > 0
-        ? { sourceValueHash: record.sourceValueHash }
-        : {}),
-    }
-    let minimumBytes = 0
-    for (const field of Object.values(entry)) {
-      minimumBytes += Buffer.byteLength(field, 'utf8')
-      if (minimumBytes > PROVENANCE_MAX_SERIALIZED_BYTES) return undefined
-    }
-    const key = JSON.stringify(entry)
-    if (entries.has(key)) continue
-    if (!budget.add(entry.encryptedValue, Buffer.byteLength(key, 'utf8'))) return undefined
-    entries.set(key, entry)
-  }
-
-  return [...entries.values()].sort(
-    (left, right) =>
-      compareStrings(left.sourceUserId ?? '', right.sourceUserId ?? '') ||
-      compareStrings(left.sourceWorkspaceId ?? '', right.sourceWorkspaceId ?? '') ||
-      compareStrings(left.sourceValueHash ?? '', right.sourceValueHash ?? '') ||
-      compareStrings(left.name ?? '', right.name ?? '') ||
-      compareStrings(left.encryptedValue, right.encryptedValue)
-  )
-}
-
 /** Converts a complete transport envelope into its scope-preserving durable representation. */
 export function durableSecretProvenanceFromEnvelope(
   provenance: ResolvedSecretTraceProvenanceV1
@@ -155,15 +104,7 @@ export function durableSecretProvenanceFromPrivateBundle(
 export function mergeDurableSecretProvenance(
   ...values: readonly DurableSecretProvenance[]
 ): DurableSecretProvenance {
-  if (values.some((value) => value.status === 'unknown')) return { status: 'unknown' }
-  const normalized = normalizeDurableSecretProvenanceBindings(
-    (function* () {
-      for (const value of values) {
-        if (value.status === 'exact') yield* value.entries
-      }
-    })()
-  )
-  return normalized ? { status: 'exact', entries: normalized } : { status: 'unknown' }
+  return mergeDurableSecretProvenanceSources(values)
 }
 
 /** Binds exact entries to one persisted sub-value so later slicing cannot activate dropped data. */
@@ -201,10 +142,11 @@ export function filterDurableSecretProvenanceBySourceValues(
 export async function importDurableSecretProvenance(
   registry: ResolvedSecretTraceRegistry,
   provenance: DurableSecretProvenance,
-  value?: unknown
+  value?: unknown,
+  options: { atomic?: boolean } = {}
 ): Promise<boolean> {
   if (provenance.status === 'unknown') {
-    registry.markIncomplete('durable-provenance-unknown')
+    if (!options.atomic) registry.markIncomplete('durable-provenance-unknown')
     return false
   }
   const entries = normalizeDurableSecretProvenanceEntries(provenance.entries)
@@ -213,7 +155,7 @@ export async function importDurableSecretProvenance(
      * Malformed is not unrecorded: a sidecar that exists but cannot be parsed is a fault, and no
      * enforcement policy relaxes it.
      */
-    registry.markIncomplete('durable-provenance-malformed')
+    if (!options.atomic) registry.markIncomplete('durable-provenance-malformed')
     return false
   }
 
@@ -244,14 +186,25 @@ export async function importDurableSecretProvenance(
     group.entries.set(JSON.stringify(transportEntry), transportEntry)
   }
 
-  let complete = true
-  for (const group of grouped.values()) {
-    const envelope: ResolvedSecretTraceProvenanceV1 = {
-      version: 1,
-      complete: true,
-      entries: [...group.entries.values()],
-      ...(group.scope ? { scope: group.scope } : {}),
+  function* envelopes(): Generator<ResolvedSecretTraceProvenanceV1> {
+    for (const group of grouped.values()) {
+      yield {
+        version: 1,
+        complete: true,
+        entries: [...group.entries.values()],
+        ...(group.scope ? { scope: group.scope } : {}),
+      }
     }
+  }
+  if (options.atomic) {
+    return registry.tryImportProvenance(envelopes(), {
+      trusted: true,
+      origin: 'durableProvenance.admission',
+      value,
+    })
+  }
+  let complete = true
+  for (const envelope of envelopes()) {
     const imported =
       value === undefined
         ? await registry.importProvenance(envelope, {
diff --git a/apps/sim/lib/execution/isolated-vm-worker.cjs b/apps/sim/lib/execution/isolated-vm-worker.cjs
index 4d2ff9ce5f8..c947ad4abe8 100644
--- a/apps/sim/lib/execution/isolated-vm-worker.cjs
+++ b/apps/sim/lib/execution/isolated-vm-worker.cjs
@@ -951,6 +951,11 @@ async function executeTask(request, executionId) {
         // Capture the bridge reference in a closure so hardening can unset the
         // global without breaking already-installed brokers.
         const __ref = globalThis.__brokerRef;
+        const __brokerErrors = new WeakMap();
+        const __rememberBrokerError = __brokerErrors.set.bind(__brokerErrors);
+        Object.defineProperty(globalThis, '__readBrokerErrorId', {
+          value: __brokerErrors.get.bind(__brokerErrors), writable: false, configurable: false
+        });
         globalThis.__brokers = globalThis.__brokers || {};
         for (const name of ${brokerNamesJson}) {
           globalThis.__brokers[name] = async (args) => {
@@ -963,7 +968,9 @@ async function executeTask(request, executionId) {
             let response;
             try { response = JSON.parse(responseJson); } catch { throw new Error('Invalid broker response'); }
             if (typeof response.error === 'string') {
-              throw new Error(response.error || 'Broker call failed');
+              const error = new Error(response.error || 'Broker call failed');
+              __rememberBrokerError(error, response.brokerErrorId);
+              throw error;
             }
             return response.resultJson === undefined || response.resultJson === null
               ? null
@@ -1016,7 +1023,7 @@ async function executeTask(request, executionId) {
       userResult = { success: true }
     } else {
       const wrappedUserCode = `
-      (async () => {
+      (async () => { const __readBrokerErrorId = globalThis.__readBrokerErrorId;
         try {
           await (async () => {
             ${code}
@@ -1029,6 +1036,7 @@ async function executeTask(request, executionId) {
               message: error && error.message ? error.message : String(error),
               name: error && error.name ? error.name : 'Error',
               stack: error && error.stack ? error.stack : '',
+              brokerErrorId: __readBrokerErrorId(error),
             },
           });
         }
@@ -1056,7 +1064,12 @@ async function executeTask(request, executionId) {
       return {
         result: null,
         stdout: stdoutChunks.join(''),
-        error: convertToCompatibleError(userResult.errorInfo, code),
+        error: {
+          ...convertToCompatibleError(userResult.errorInfo, code),
+          ...(Number.isSafeInteger(userResult.errorInfo.brokerErrorId)
+            ? { brokerErrorId: userResult.errorInfo.brokerErrorId }
+            : {}),
+        },
         timings,
       }
     }
@@ -1233,7 +1246,13 @@ process.on('message', async (msg) => {
       if (pending) {
         clearTimeout(pending.timeout)
         pendingBrokerCalls.delete(msg.brokerId)
-        pending.resolve(JSON.stringify({ error: msg.error, resultJson: msg.resultJson }))
+        pending.resolve(
+          JSON.stringify({
+            error: msg.error,
+            resultJson: msg.resultJson,
+            ...(typeof msg.error === 'string' ? { brokerErrorId: msg.brokerId } : {}),
+          })
+        )
       }
     }
   } catch (err) {
diff --git a/apps/sim/lib/execution/isolated-vm.ts b/apps/sim/lib/execution/isolated-vm.ts
index 8292b05beba..936186f9455 100644
--- a/apps/sim/lib/execution/isolated-vm.ts
+++ b/apps/sim/lib/execution/isolated-vm.ts
@@ -66,7 +66,7 @@ interface IsolatedVMTaskRequest {
  * Host-side broker handler invoked when isolate code calls a broker.
  * Registered per-request via `executeInIsolatedVM(..., { brokers })`.
  */
-export type IsolatedVMBrokerHandler = (args: unknown) => Promise<unknown>
+export type IsolatedVMBrokerHandler = (args: unknown, brokerId: number) => Promise<unknown>
 
 export interface IsolatedVMExecutionOptions {
   /** Broker name → handler. Must cover every broker listed in `request.task.brokers`. */
@@ -104,6 +104,8 @@ interface IsolatedVMTaskTimings {
 }
 
 interface IsolatedVMError {
+  /** Existing broker call ID, set only when a task propagates that broker's error object. */
+  brokerErrorId?: number
   message: string
   name: string
   stack?: string
@@ -735,7 +737,7 @@ function handleBrokerMessage(
   }
 
   Promise.resolve()
-    .then(() => pending.runInOutboundScope(() => handler(args)))
+    .then(() => pending.runInOutboundScope(() => handler(args, brokerId)))
     .then((resultValue) => {
       if (pending.cancelled) {
         sendResponse({ error: 'Execution cancelled' })
diff --git a/apps/sim/lib/execution/provenance-entries.ts b/apps/sim/lib/execution/provenance-entries.ts
new file mode 100644
index 00000000000..b7ed0bdef1c
--- /dev/null
+++ b/apps/sim/lib/execution/provenance-entries.ts
@@ -0,0 +1,78 @@
+import type { DurableSecretProvenanceEntry } from '@sim/db/schema'
+import { compareStrings } from '@sim/utils/string'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
+import { PROVENANCE_MAX_SERIALIZED_BYTES } from '@/lib/execution/provenance-limits'
+
+/** Normalizes and folds streamed durable bindings within the existing provenance budget. */
+export function normalizeDurableSecretProvenanceBindings(
+  candidates: Iterable<unknown>
+): DurableSecretProvenanceEntry[] | undefined {
+  const entries = new Map<string, DurableSecretProvenanceEntry>()
+  const budget = new SecretProvenanceBudget()
+  for (const candidate of candidates) {
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) return undefined
+    const record = candidate as Record<string, unknown>
+    if (
+      typeof record.encryptedValue !== 'string' ||
+      record.encryptedValue.length === 0 ||
+      (record.name !== undefined && typeof record.name !== 'string') ||
+      (record.sourceUserId !== undefined && typeof record.sourceUserId !== 'string') ||
+      (record.sourceWorkspaceId !== undefined && typeof record.sourceWorkspaceId !== 'string') ||
+      (record.sourceValueHash !== undefined && typeof record.sourceValueHash !== 'string') ||
+      (record.sourceWorkspaceId !== undefined && record.sourceUserId === undefined)
+    ) {
+      return undefined
+    }
+    const entry: DurableSecretProvenanceEntry = {
+      encryptedValue: record.encryptedValue,
+      ...(typeof record.name === 'string' && record.name.length > 0 ? { name: record.name } : {}),
+      ...(typeof record.sourceUserId === 'string' && record.sourceUserId.length > 0
+        ? { sourceUserId: record.sourceUserId }
+        : {}),
+      ...(typeof record.sourceWorkspaceId === 'string' && record.sourceWorkspaceId.length > 0
+        ? { sourceWorkspaceId: record.sourceWorkspaceId }
+        : {}),
+      ...(typeof record.sourceValueHash === 'string' && record.sourceValueHash.length > 0
+        ? { sourceValueHash: record.sourceValueHash }
+        : {}),
+    }
+    let minimumBytes = 0
+    for (const field of Object.values(entry)) {
+      minimumBytes += Buffer.byteLength(field, 'utf8')
+      if (minimumBytes > PROVENANCE_MAX_SERIALIZED_BYTES) return undefined
+    }
+    const key = JSON.stringify(entry)
+    if (entries.has(key)) continue
+    if (!budget.add(entry.encryptedValue, Buffer.byteLength(key, 'utf8'))) return undefined
+    entries.set(key, entry)
+  }
+
+  return [...entries.values()].sort(
+    (left, right) =>
+      compareStrings(left.sourceUserId ?? '', right.sourceUserId ?? '') ||
+      compareStrings(left.sourceWorkspaceId ?? '', right.sourceWorkspaceId ?? '') ||
+      compareStrings(left.sourceValueHash ?? '', right.sourceValueHash ?? '') ||
+      compareStrings(left.name ?? '', right.name ?? '') ||
+      compareStrings(left.encryptedValue, right.encryptedValue)
+  )
+}
+
+/** Merges streamed source evidence within the shared budget without materializing the sources. */
+export function mergeDurableSecretProvenanceSources(
+  values: Iterable<DurableSecretProvenance>
+): DurableSecretProvenance {
+  let unknown = false
+  const normalized = normalizeDurableSecretProvenanceBindings(
+    (function* () {
+      for (const value of values) {
+        if (value.status === 'unknown') {
+          unknown = true
+          return
+        }
+        yield* value.entries
+      }
+    })()
+  )
+  return !unknown && normalized ? { status: 'exact', entries: normalized } : { status: 'unknown' }
+}
diff --git a/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
new file mode 100644
index 00000000000..c6cabb09ca8
--- /dev/null
+++ b/apps/sim/lib/execution/sandbox/__integration__/content-reads.integration.ts
@@ -0,0 +1,337 @@
+import { execFile } from 'node:child_process'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { db } from '@sim/db'
+import { auditLog, organization, user, workspace, workspaceFiles } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { toolsMock, toolsMockFns } from '@sim/testing/mocks/tools.mock'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/tools', () => toolsMock)
+
+import { observeContentDelivery } from '@/lib/core/application'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
+import { executeFunctionExecute } from '@/lib/mothership/tools/handlers/function-execute'
+import { compileDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { compileDocForWrite } from '@/lib/mothership/tools/server/files/workspace-file'
+import {
+  updateWorkspaceFileContent,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { getBoundWorkspaceFileSecretProvenanceByIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const execute = promisify(execFile)
+const secret = 'synthetic-broker-value-987654321'
+
+describe('Chat admits the file revision used by a sandbox', () => {
+  const ids = createKnowledgeAclFixtureIds()
+  const chatId = generateId()
+  let fileId: string
+  let workbench: string
+
+  beforeAll(async () => {
+    storage.root = await mkdtemp(join(tmpdir(), 'sim-broker-content-'))
+    workbench = await mkdtemp(join(tmpdir(), 'sim-input-content-'))
+    await seedKnowledgeAclFixture(ids)
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from('public bytes'),
+      'source.txt',
+      'text/plain',
+      { notifyWorkspaceChange: false }
+    )
+    fileId = file.id
+  })
+  afterAll(async () => {
+    await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+    await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+    await db.delete(organization).where(eq(organization.id, ids.organizationId))
+    await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+    await rm(storage.root, { recursive: true, force: true })
+    await rm(workbench, { recursive: true, force: true })
+  })
+
+  function compile(source: string, registry: ResolvedSecretTraceRegistry) {
+    return observeContentDelivery(
+      createRegistryContentGate({
+        registry,
+        workspaceId: ids.workspaceId,
+        actorUserId: ids.aliceId,
+      }),
+      () =>
+        compileDoc({
+          source,
+          fileName: 'fixture.pdf',
+          workspaceId: ids.workspaceId,
+          filePrincipal: createCopilotChatFilePrincipal({
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+            chatId,
+          }),
+        })
+    )
+  }
+  function registry() {
+    return new ResolvedSecretTraceRegistry([], {
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+    })
+  }
+
+  it('reads variable file references through the real isolated worker and invalidates cached source revisions', async () => {
+    const source = `const id = ${JSON.stringify(fileId)}; const data = await getFileBase64(id); pdf.addPage().drawText(data);`
+    const first = await compile(source, registry())
+    expect(first.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(first.contributingFiles).toHaveLength(1)
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('updated public bytes'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'exact', entries: [] } },
+      }
+    )
+    const second = await compile(source, registry())
+    expect(second.contributingFiles?.[0].key).not.toBe(first.contributingFiles?.[0].key)
+    const revisions = [...(first.contributingFiles ?? []), ...(second.contributingFiles ?? [])]
+    for (const identities of [revisions, [...revisions].reverse()]) {
+      const bound = await getBoundWorkspaceFileSecretProvenanceByIdentity(
+        ids.workspaceId,
+        identities
+      )
+      expect(bound.get(fileId)).toEqual({ status: 'unknown' })
+    }
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified bytes'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    await expect(compile(source, registry())).rejects.toThrow(/provenance|read safely/i)
+  }, 60_000)
+
+  it('imports evidence before a broker response can appear in a compiler error', async () => {
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from(secret),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: {
+          mode: 'replace',
+          provenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'BROKER_TOKEN',
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+              },
+            ],
+          },
+        },
+      }
+    )
+    const trace = registry()
+    let message = ''
+    try {
+      await compile(
+        `const id = ${JSON.stringify(fileId)}; const uri = await getFileBase64(id); throw new Error(Buffer.from(uri.split(',')[1], 'base64').toString());`,
+        trace
+      )
+    } catch (error) {
+      if (!(error instanceof Error)) throw error
+      message = error.message
+    }
+    expect(message).toContain(secret)
+    const projected = projectResolvedSecretModelContent(message, trace)
+    if (!projected.safe) throw new Error('Expected a safely projected compiler error')
+    expect(projected.value).not.toContain(secret)
+    expect(projected.value).toContain('{{BROKER_TOKEN}}')
+  }, 60_000)
+
+  it('admits broker inputs during legacy document-write validation before returning compiler errors', async () => {
+    const principal = createCopilotChatFilePrincipal({
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      chatId,
+    })
+    const validate = (source: string, trace: ResolvedSecretTraceRegistry) =>
+      observeContentDelivery(
+        createRegistryContentGate({
+          registry: trace,
+          workspaceId: ids.workspaceId,
+          actorUserId: ids.aliceId,
+        }),
+        () =>
+          compileDocForWrite({
+            source,
+            fileName: 'write-validation.pdf',
+            workspaceId: ids.workspaceId,
+            principal,
+            ownerKey: `user:${ids.aliceId}`,
+            fallbackMime: 'application/pdf',
+          })
+      )
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified input'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    const refused = await validate(
+      `const id = ${JSON.stringify(fileId)}; await getFileBase64(id); pdf.addPage();`,
+      registry()
+    )
+    expect.soft(refused).toMatchObject({ ok: false })
+    if (!refused.ok) expect(refused.message).toMatch(/provenance|read safely/i)
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from(secret),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: {
+          mode: 'replace',
+          provenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'BROKER_TOKEN',
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+              },
+            ],
+          },
+        },
+      }
+    )
+    const trace = registry()
+    const failed = await validate(
+      `const id = ${JSON.stringify(fileId)}; const uri = await getFileBase64(id); throw new Error(Buffer.from(uri.split(',')[1], 'base64').toString());`,
+      trace
+    )
+    expect(failed.ok).toBe(false)
+    if (failed.ok) throw new Error('Expected the document source to fail')
+    expect(failed.message).toContain(secret)
+    const projected = projectResolvedSecretModelContent(failed.message, trace)
+    if (!projected.safe) throw new Error('Expected a safely projected compiler error')
+    expect(projected.value).not.toContain(secret)
+    expect(projected.value).toContain('{{BROKER_TOKEN}}')
+  }, 60_000)
+
+  it('keeps successful legacy dynamic-input documents readable after their first compile', async () => {
+    const references = Array.from({ length: 501 }, (_, index) => ({
+      id: `wf_${generateId()}`,
+      key: `workspace/${ids.workspaceId}/cache-reference-${generateId()}.txt`,
+      originalName: `reference-${index}.txt`,
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      context: 'workspace',
+      contentType: 'text/plain',
+      sizeBytes: 6,
+    }))
+    await db.insert(workspaceFiles).values(references)
+    await mkdir(join(storage.root, 'workspace', ids.workspaceId), { recursive: true })
+    for (const reference of references) {
+      await writeFile(join(storage.root, reference.key), 'public')
+    }
+    const source = `const ids = ${JSON.stringify(references.map((file) => file.id))}; for (const id of ids) await getFileBase64(id); pdf.addPage().drawText('compiled all references');`
+    const first = await compile(source, registry())
+    expect(first.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(first.contributingFiles).toHaveLength(references.length)
+    const second = await compile(source, registry())
+    expect(second.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(second.contributingFiles).toHaveLength(references.length)
+  }, 120_000)
+
+  it('does not run code with a stale local file after refusing its requested replacement', async () => {
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified replacement'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    await writeFile(join(workbench, 'source.txt'), 'previous mounted version')
+    await writeFile(join(workbench, 'result.txt'), 'not executed')
+    toolsMockFns.mockExecuteTool.mockImplementation(async (_id, params: { code: string }) => {
+      const output = await execute(process.execPath, ['-e', params.code], { cwd: workbench })
+      return { success: true, output }
+    })
+    const context = {
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      chatId,
+      toolCallId: generateId(),
+      workflowId: '',
+      copilotToolExecution: true,
+      resolvedSecretTraceRegistry: registry(),
+    }
+    const code =
+      "const fs = require('node:fs'); fs.writeFileSync('result.txt', fs.readFileSync('source.txt'));"
+    const result = await executeFunctionExecute(
+      {
+        code,
+        language: 'javascript',
+        inputs: { files: [{ path: fileId, sandboxPath: '/tmp/source.txt' }] },
+      },
+      context
+    )
+    expect(await readFile(join(workbench, 'result.txt'), 'utf8')).toBe('not executed')
+    expect(result).toMatchObject({
+      success: false,
+      output: { codeExecuted: false, excludedInputs: [{ path: '/tmp/source.txt' }] },
+    })
+    expect(context.resolvedSecretTraceRegistry.isComplete()).toBe(true)
+    const next = await executeFunctionExecute(
+      { code: "process.stdout.write('clock usable')", language: 'javascript' },
+      context
+    )
+    expect(next).toMatchObject({ success: true, output: { stdout: 'clock usable' } })
+  })
+})
diff --git a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
index 32277c4419b..6be2e8196df 100644
--- a/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
+++ b/apps/sim/lib/execution/sandbox/brokers/workspace-file.ts
@@ -8,6 +8,7 @@ import {
   fetchWorkspaceFileBuffer,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
 
 const logger = createLogger('SandboxWorkspaceFileBroker')
 
@@ -34,8 +35,24 @@ export const workspaceFileBroker: SandboxBroker<WorkspaceFileArgs, WorkspaceFile
     if (!ctx.workspaceId) {
       throw new Error('workspaceFile broker requires a workspaceId')
     }
+    const admitted = ctx.filePrincipal
+      ? await readWorkspaceFileContent.execute({
+          principal: ctx.filePrincipal,
+          input: {
+            fileId: args.fileId,
+            assertedWorkspaceId: ctx.workspaceId,
+            maxBytes:
+              Math.floor(
+                Math.min(
+                  MAX_SANDBOX_IMAGE_DATA_URI_CHARS,
+                  MAX_ISOLATED_VM_BROKER_RESULT_JSON_CHARS
+                ) / 4
+              ) * 3,
+          },
+        })
+      : undefined
 
-    const record = await getWorkspaceFile(ctx.workspaceId, args.fileId)
+    const record = admitted?.file ?? (await getWorkspaceFile(ctx.workspaceId, args.fileId))
     if (!record) {
       logger.warn('Workspace file not found for sandbox broker', {
         workspaceId: ctx.workspaceId,
@@ -55,7 +72,9 @@ export const workspaceFileBroker: SandboxBroker<WorkspaceFileArgs, WorkspaceFile
       )
     )
     const maxBytes = Math.floor(availableBase64Chars / 4) * 3
-    const buffer = await fetchWorkspaceFileBuffer(record, { maxBytes })
+    const buffer = admitted?.content ?? (await fetchWorkspaceFileBuffer(record, { maxBytes }))
+    if (buffer.length > maxBytes)
+      throw new Error('Workspace file exceeds the sandbox image byte limit')
     ctx.onWorkspaceFileAccess?.({
       fileId: record.id,
       key: record.key,
diff --git a/apps/sim/lib/execution/sandbox/run-task.ts b/apps/sim/lib/execution/sandbox/run-task.ts
index d28d5175d54..7e09020b196 100644
--- a/apps/sim/lib/execution/sandbox/run-task.ts
+++ b/apps/sim/lib/execution/sandbox/run-task.ts
@@ -1,5 +1,7 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
+import { ContentRefusedError } from '@/lib/core/application'
 import {
   executeInIsolatedVM,
   type IsolatedVMBrokerHandler,
@@ -20,6 +22,7 @@ export interface RunSandboxTaskOptions {
   signal?: AbortSignal
   /** Records canonical workspace files whose bytes were successfully read by a task broker. */
   onWorkspaceFileAccess?: SandboxBrokerContext['onWorkspaceFileAccess']
+  filePrincipal?: SandboxBrokerContext['filePrincipal']
   /** Run id that brokers see as `ctx.requestId`, for callers that keep per-run broker state. */
   requestId?: string
 }
@@ -59,10 +62,23 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
     workspaceId: input.workspaceId,
     requestId,
     onWorkspaceFileAccess: options.onWorkspaceFileAccess,
+    filePrincipal: options.filePrincipal,
   }
   const brokers: Record<string, IsolatedVMBrokerHandler> = {}
+  const runInCallerContext = AsyncLocalStorage.snapshot()
+  let brokerRefusals: Map<number, ContentRefusedError> | undefined
   for (const broker of task.brokers) {
-    brokers[broker.name] = (args) => broker.handle(brokerContext, args)
+    brokers[broker.name] = async (args, brokerId) => {
+      try {
+        return await runInCallerContext(() => broker.handle(brokerContext, args))
+      } catch (error) {
+        if (error instanceof ContentRefusedError) {
+          brokerRefusals ??= new Map()
+          brokerRefusals.set(brokerId, error)
+        }
+        throw error
+      }
+    }
   }
 
   const request: IsolatedVMExecutionRequest = {
@@ -120,6 +136,11 @@ export async function runSandboxTask<TInput extends SandboxTaskInput>(
       if (result.error.stack) err.stack = result.error.stack
       throw err
     }
+    const brokerRefusal =
+      result.error.brokerErrorId === undefined
+        ? undefined
+        : brokerRefusals?.get(result.error.brokerErrorId)
+    if (brokerRefusal) throw brokerRefusal
     throw new SandboxUserCodeError(
       result.error.message,
       result.error.name || 'SandboxTaskError',
diff --git a/apps/sim/lib/execution/sandbox/types.ts b/apps/sim/lib/execution/sandbox/types.ts
index ee7082ac094..eaa3066da29 100644
--- a/apps/sim/lib/execution/sandbox/types.ts
+++ b/apps/sim/lib/execution/sandbox/types.ts
@@ -1,3 +1,5 @@
+import type { Principal } from '@sim/auth/principal'
+
 /**
  * Types for the sandbox task system.
  *
@@ -24,6 +26,8 @@ export interface SandboxBroker<TArgs = unknown, TResult = unknown> {
 export interface SandboxBrokerContext {
   workspaceId: string
   requestId: string
+  /** Host-side identity used to authorize and admit each actual broker read. Never sent to the isolate. */
+  filePrincipal?: Principal
   onWorkspaceFileAccess?: (identity: {
     fileId: string
     key: string
diff --git a/apps/sim/lib/file-parsers/json-parser.test.ts b/apps/sim/lib/file-parsers/json-parser.test.ts
index 0a4d110e087..99b779d75f4 100644
--- a/apps/sim/lib/file-parsers/json-parser.test.ts
+++ b/apps/sim/lib/file-parsers/json-parser.test.ts
@@ -33,4 +33,29 @@ describe('JSON parser complexity limits', () => {
       code: 'invalid_format',
     })
   })
+
+  /**
+   * Text extraction errors reach Chat as the read's error, and egress redaction recognizes only
+   * whole secrets, so a message quoting a clipped excerpt of the file could carry part of one.
+   */
+  it.each([
+    [
+      'JSON',
+      parseJSONBuffer,
+      `{"config": {"key": sk_live_FIXTURE_0123456789abcdefghij${'x'.repeat(200)}}}`,
+    ],
+    [
+      'JSONL',
+      parseJSONLBuffer,
+      `{"ok": true}\n{"key": "${'x'.repeat(80)}sk_live_FIXTURE_0123456789abcdefghij`,
+    ],
+  ] as const)(
+    'names where invalid %s fails without quoting the file',
+    async (_kind, parse, text) => {
+      const error = await parse(Buffer.from(text)).catch((caught: unknown) => caught)
+      expect(error).toMatchObject({ code: 'invalid_format' })
+      expect(String((error as Error).message)).not.toContain('sk_l')
+      expect(String((error as Error).message)).not.toContain('xxxx')
+    }
+  )
 })
diff --git a/apps/sim/lib/file-parsers/json-parser.ts b/apps/sim/lib/file-parsers/json-parser.ts
index 562e4cbcd43..b8e9c236fe2 100644
--- a/apps/sim/lib/file-parsers/json-parser.ts
+++ b/apps/sim/lib/file-parsers/json-parser.ts
@@ -213,6 +213,18 @@ export function stripJsonComments(text: string): string {
   return out.replace(/,(\s*[}\]])/g, '$1')
 }
 
+/** V8's excerpt of the input: `Unexpected token 's', "…{"key": sk_l"... is not valid JSON`. */
+const QUOTED_INPUT_EXCERPT = /,\s*(?:\.\.\.)?".*"(?:\.\.\.)?\s+is not valid JSON$/s
+
+/**
+ * A parse failure's message without the clipped excerpt of the input V8 quotes in it. The message
+ * reaches Chat as the read's error, where redaction matches whole secrets only, so an excerpt cut
+ * through a secret would carry the part that survived the cut.
+ */
+function describeSyntaxError(error: unknown): string {
+  return getErrorMessage(error, 'Unknown error').replace(QUOTED_INPUT_EXCERPT, '')
+}
+
 function parseJsonContent(buffer: Uint8Array): FileParseResult {
   const decoded = decodeTextBuffer(buffer)
   try {
@@ -226,7 +238,7 @@ function parseJsonContent(buffer: Uint8Array): FileParseResult {
     if (lenient) return lenient
     throw new FileParserError(
       'invalid_format',
-      `Invalid JSON: ${getErrorMessage(error, 'Unknown error')}`,
+      `Invalid JSON: ${describeSyntaxError(error)}`,
       error
     )
   }
@@ -282,7 +294,7 @@ function parseJsonLinesContent(buffer: Uint8Array): FileParseResult {
     } catch (error) {
       throw new FileParserError(
         'invalid_format',
-        `Invalid JSONL on line ${lineNumber}: ${line.slice(0, 100)}`,
+        `Invalid JSONL on line ${lineNumber}: ${describeSyntaxError(error)}`,
         error
       )
     }
diff --git a/apps/sim/lib/function-execution/application/execute-chat-function.ts b/apps/sim/lib/function-execution/application/execute-chat-function.ts
index ed083afddc4..ec70b8bce40 100644
--- a/apps/sim/lib/function-execution/application/execute-chat-function.ts
+++ b/apps/sim/lib/function-execution/application/execute-chat-function.ts
@@ -21,11 +21,13 @@ export const executeChatFunction = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'function-executions.execute_chat',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/function-execution/application/operations.ts b/apps/sim/lib/function-execution/application/operations.ts
index bae1baceacd..e899d8913f2 100644
--- a/apps/sim/lib/function-execution/application/operations.ts
+++ b/apps/sim/lib/function-execution/application/operations.ts
@@ -7,6 +7,7 @@ export const functionExecutionOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['executor', 'copilot'],
   }),
diff --git a/apps/sim/lib/invitations/application/list-workspace-invitations.ts b/apps/sim/lib/invitations/application/list-workspace-invitations.ts
index ad2b66a4c61..ffd094bb85e 100644
--- a/apps/sim/lib/invitations/application/list-workspace-invitations.ts
+++ b/apps/sim/lib/invitations/application/list-workspace-invitations.ts
@@ -8,6 +8,7 @@ export const listWorkspaceInvitationsOperation = defineWorkspaceOperation({
   id: 'workspace_invitations.list',
   minimumRole: 'admin',
   capability: 'none',
+  contentDelivery: 'none',
   workspaceApiKey: 'deny',
   principalKinds: ['session', 'delegated'],
   delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/manage-invitation.ts b/apps/sim/lib/invitations/application/manage-invitation.ts
index 20b37b67a8e..3c04ae48435 100644
--- a/apps/sim/lib/invitations/application/manage-invitation.ts
+++ b/apps/sim/lib/invitations/application/manage-invitation.ts
@@ -27,6 +27,7 @@ export const invitationManagementOperations = {
   /** permission-group-exempt: cancellation removes access and remains available when sends are withheld. */
   cancel: defineOrganizationOperation({
     id: 'organization_invitations.cancel',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'organization_delegated'],
@@ -36,6 +37,7 @@ export const invitationManagementOperations = {
   /** permission-group-exempt: resend checks invitations.send against each canonical admission and workspace scope below. */
   resend: defineOrganizationOperation({
     id: 'organization_invitations.resend',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'organization_delegated'],
@@ -256,6 +258,7 @@ export const workspaceInvitationManagementOperations = {
     id: 'workspace_invitations.cancel',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
@@ -264,6 +267,7 @@ export const workspaceInvitationManagementOperations = {
     id: 'workspace_invitations.resend',
     minimumRole: 'admin',
     capability: 'invitations.send',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/operations.ts b/apps/sim/lib/invitations/application/operations.ts
index 435e6474ba4..d72e3c74c41 100644
--- a/apps/sim/lib/invitations/application/operations.ts
+++ b/apps/sim/lib/invitations/application/operations.ts
@@ -60,6 +60,7 @@ export const workspaceInvitationOperations = {
     id: 'workspace_invitations.send_batch',
     minimumRole: 'admin',
     capability: 'invitations.send',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/invitations/application/send-invitation-batch.ts b/apps/sim/lib/invitations/application/send-invitation-batch.ts
index fde30ee9262..9e2d7ca5588 100644
--- a/apps/sim/lib/invitations/application/send-invitation-batch.ts
+++ b/apps/sim/lib/invitations/application/send-invitation-batch.ts
@@ -341,6 +341,7 @@ export const sendWorkspaceInvitationBatch = defineAuthorizedWorkspaceUseCase({
 
 const organizationInvitationSendOperation = defineOrganizationOperation({
   id: 'organization_invitations.send_batch',
+  contentDelivery: 'none',
   minimumRole: 'admin',
   capability: 'invitations.send',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
new file mode 100644
index 00000000000..33f44ead783
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/content-delivery.integration.ts
@@ -0,0 +1,604 @@
+/** Real PostgreSQL content admission, pagination, captured metadata, and streamed ZIP readback. */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import * as audit from '@sim/audit'
+import { db } from '@sim/db'
+import {
+  auditLog,
+  document,
+  embedding,
+  knowledgeBase,
+  organization,
+  user,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { sha256Hex } from '@sim/security/hash'
+import { generateId } from '@sim/utils/id'
+import { isRecordLike } from '@sim/utils/object'
+import { eq, inArray } from 'drizzle-orm'
+import { PostgresJsPreparedQuery } from 'drizzle-orm/postgres-js/session'
+import JSZip from 'jszip'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+
+import { observeContentDelivery } from '@/lib/core/application'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
+import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import * as knowledgeContexts from '@/lib/knowledge/application/contexts'
+import { listKnowledgeDocuments } from '@/lib/knowledge/application/documents'
+import {
+  exportKnowledgeBase,
+  type KnowledgeBaseExportBundle,
+} from '@/lib/knowledge/application/exports'
+import { readOriginalKnowledgeDocument } from '@/lib/knowledge/application/read-original-document'
+import {
+  readDetailedKnowledgeTagUsage,
+  readKnowledgeTagUsage,
+} from '@/lib/knowledge/application/tags'
+import {
+  bindKnowledgeDocumentFieldSecretProvenance,
+  classifyKnowledgeDocumentMetadata,
+  createKnowledgeDocumentSourceValue,
+  replaceKnowledgeDocumentSecretProvenanceInTx,
+  replaceKnowledgeEmbeddingSecretProvenanceInTx,
+} from '@/lib/knowledge/secret-provenance'
+import { buildKnowledgeBundleArchive } from '@/lib/knowledge/transfer/export-archive'
+import { embeddingVectorValues } from '@/lib/knowledge/vector-columns'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { uploadFile } from '@/lib/uploads/core/storage-service'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const SECRET = 'fixture-knowledge-token-41875'
+const ids = createKnowledgeAclFixtureIds()
+const principal = createCopilotChatPrincipal(
+  { userId: ids.aliceId, workspaceId: ids.workspaceId },
+  KNOWLEDGE_DELEGATION_AUDIENCE
+)
+const session = { kind: 'session' as const, userId: ids.aliceId, sessionId: generateId() }
+let exact: DurableSecretProvenance
+let submittedAudits = 0
+
+function inChat<T>(read: () => T) {
+  return observeContentDelivery(
+    createRegistryContentGate({
+      registry: new ResolvedSecretTraceRegistry([], {
+        userId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      }),
+      actorUserId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+    }),
+    read
+  )
+}
+
+async function seedDocument(
+  options: {
+    name?: string
+    content?: string
+    provenance?: DurableSecretProvenance
+    original?: boolean
+  } = {}
+) {
+  const content = options.content ?? 'page public content'
+  const id = generateId()
+  const [row] = await db
+    .insert(document)
+    .values({
+      id,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      filename: options.name ?? 'page.txt',
+      fileUrl:
+        options.original === false
+          ? ''
+          : `data:text/plain;base64,${Buffer.from(content).toString('base64')}`,
+      fileSize: Buffer.byteLength(content),
+      mimeType: 'text/plain',
+      processingStatus: 'completed',
+      chunkCount: 1,
+      tag1: 'public',
+      acl: ['ws'],
+      aclRequirements: [],
+      aclVerifiedAt: new Date(),
+    })
+    .returning()
+  const provenance = options.provenance
+  if (provenance)
+    await db.transaction((tx) =>
+      replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        id,
+        createKnowledgeDocumentSourceValue(row),
+        provenance
+      )
+    )
+  const chunkId = await seedChunk(id, 0, content)
+  return { id, chunkId, content }
+}
+
+async function seedChunk(
+  documentId: string,
+  index: number,
+  content: string,
+  provenance?: DurableSecretProvenance
+) {
+  const id = generateId()
+  await db.insert(embedding).values({
+    id,
+    documentId,
+    knowledgeBaseId: ids.knowledgeBaseId,
+    chunkIndex: index,
+    ...embeddingVectorValues(1536, [1, ...Array<number>(1535).fill(0)]),
+    chunkHash: sha256Hex(content),
+    content,
+    contentLength: content.length,
+    tokenCount: 4,
+    startOffset: 0,
+    endOffset: content.length,
+    tag1: 'public',
+  })
+  if (provenance)
+    await db.transaction((tx) =>
+      replaceKnowledgeEmbeddingSecretProvenanceInTx(tx, id, content, provenance)
+    )
+  return id
+}
+
+async function exportedBundle(human = false) {
+  return inChat(() =>
+    exportKnowledgeBase.execute({
+      principal: human ? session : principal,
+      input: { knowledgeBaseId: ids.knowledgeBaseId, vectors: false },
+    })
+  )
+}
+
+async function archiveBytes(bundle: KnowledgeBaseExportBundle) {
+  const buffers: Buffer[] = []
+  for await (const chunk of buildKnowledgeBundleArchive(bundle)) buffers.push(Buffer.from(chunk))
+  return Buffer.concat(buffers)
+}
+
+async function drainAudits() {
+  await vi.waitFor(async () =>
+    expect(
+      await db
+        .select({ id: auditLog.id })
+        .from(auditLog)
+        .where(eq(auditLog.workspaceId, ids.workspaceId))
+    ).toHaveLength(submittedAudits)
+  )
+}
+
+beforeAll(async () => {
+  fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-knowledge-delivery-'))
+  await seedKnowledgeAclFixture(ids)
+  const record = audit.recordAudit
+  vi.spyOn(audit, 'recordAudit').mockImplementation((entry) => {
+    if (entry.workspaceId === ids.workspaceId) submittedAudits += 1
+    record(entry)
+  })
+  const recordBatch = audit.recordAuditBatch
+  vi.spyOn(audit, 'recordAuditBatch').mockImplementation((entries) => {
+    submittedAudits += entries.filter((entry) => entry.workspaceId === ids.workspaceId).length
+    recordBatch(entries)
+  })
+  exact = {
+    status: 'exact',
+    entries: [
+      {
+        encryptedValue: (await encryptSecret(SECRET)).encrypted,
+        sourceUserId: ids.aliceId,
+        sourceWorkspaceId: ids.workspaceId,
+        name: 'FIXTURE_TOKEN',
+      },
+    ],
+  }
+})
+afterEach(async () => {
+  await drainAudits()
+  await db.delete(document).where(eq(document.knowledgeBaseId, ids.knowledgeBaseId))
+})
+afterAll(async () => {
+  await drainAudits()
+  vi.restoreAllMocks()
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await db.delete(knowledgeBase).where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  await rm(fixtureStorage.root, { recursive: true, force: true })
+  await db.$client.end()
+})
+
+describe('knowledge content delivery', () => {
+  it('classifies a mixed metadata page without materializing multiple inline originals together', async () => {
+    const content = 'inline source content '.repeat(8192)
+    const legacy = await seedDocument({ content })
+    const clean = await seedDocument({ content, provenance: { status: 'exact', entries: [] } })
+    const unknown = await seedDocument({ content, provenance: { status: 'unknown' } })
+    const tracked = await seedDocument({ content })
+    const [trackedRow] = await db
+      .update(document)
+      .set({ tag1: SECRET })
+      .where(eq(document.id, tracked.id))
+      .returning()
+    await db.transaction((tx) =>
+      replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        tracked.id,
+        createKnowledgeDocumentSourceValue(trackedRow),
+        bindKnowledgeDocumentFieldSecretProvenance(exact, 'tag1', SECRET)
+      )
+    )
+    const originalBytes = Buffer.byteLength(
+      `data:text/plain;base64,${Buffer.from(content).toString('base64')}`
+    )
+    let peakOriginalBytes = 0
+    const execute = PostgresJsPreparedQuery.prototype.execute
+    const measure = vi
+      .spyOn(PostgresJsPreparedQuery.prototype, 'execute')
+      .mockImplementation(async function (this: typeof PostgresJsPreparedQuery.prototype, values) {
+        const rows = await execute.call(this, values)
+        if (Array.isArray(rows)) {
+          let bytes = 0
+          for (const row of rows) {
+            if (!isRecordLike(row)) continue
+            const value = row.fileUrl
+            if (typeof value === 'string' && value.startsWith('data:'))
+              bytes += Buffer.byteLength(value)
+          }
+          peakOriginalBytes = Math.max(peakOriginalBytes, bytes)
+        }
+        return rows
+      })
+    try {
+      const result = await classifyKnowledgeDocumentMetadata([
+        legacy.id,
+        clean.id,
+        unknown.id,
+        tracked.id,
+      ])
+      expect(result.get(legacy.id)).toEqual({ status: 'exact', entries: [] })
+      expect(result.get(clean.id)).toEqual({ status: 'exact', entries: [] })
+      expect(result.get(unknown.id)).toEqual({ status: 'unknown' })
+      expect(result.get(tracked.id)).toMatchObject({
+        status: 'exact',
+        entries: [{ name: 'FIXTURE_TOKEN' }],
+      })
+      expect(peakOriginalBytes).toBeGreaterThan(0)
+      expect(peakOriginalBytes).toBeLessThanOrEqual(originalBytes)
+    } finally {
+      measure.mockRestore()
+    }
+  })
+
+  it('streams chunk pages without reloading the tracked inline original for each page', async () => {
+    const content = 'inline original content '.repeat(4096)
+    const doc = await seedDocument({ content, provenance: { status: 'exact', entries: [] } })
+    await db.insert(embedding).values(
+      Array.from({ length: 100 }, (_, index) => {
+        const text = `public exported chunk ${index + 1}`
+        return {
+          id: generateId(),
+          documentId: doc.id,
+          knowledgeBaseId: ids.knowledgeBaseId,
+          chunkIndex: index + 1,
+          ...embeddingVectorValues(1536, [1, ...Array<number>(1535).fill(0)]),
+          chunkHash: sha256Hex(text),
+          content: text,
+          contentLength: text.length,
+          tokenCount: 4,
+          startOffset: 0,
+          endOffset: text.length,
+          tag1: 'public',
+        }
+      })
+    )
+    const bundle = await inChat(() =>
+      exportKnowledgeBase.execute({
+        principal,
+        input: { knowledgeBaseId: ids.knowledgeBaseId, vectors: true },
+      })
+    )
+    const originalBytes = Buffer.byteLength(
+      `data:text/plain;base64,${Buffer.from(content).toString('base64')}`
+    )
+    let loadedOriginalBytes = 0
+    const execute = PostgresJsPreparedQuery.prototype.execute
+    const measure = vi
+      .spyOn(PostgresJsPreparedQuery.prototype, 'execute')
+      .mockImplementation(async function (this: typeof PostgresJsPreparedQuery.prototype, values) {
+        const rows = await execute.call(this, values)
+        if (Array.isArray(rows)) {
+          for (const row of rows) {
+            if (!isRecordLike(row)) continue
+            const value = row.fileUrl
+            if (typeof value === 'string' && value.startsWith('data:'))
+              loadedOriginalBytes += Buffer.byteLength(value)
+          }
+        }
+        return rows
+      })
+    try {
+      const exported: string[] = []
+      for await (const chunk of bundle.chunks(doc.id)) exported.push(chunk.content)
+      expect(exported).toHaveLength(101)
+      expect(exported[0]).toBe(content)
+      expect(exported.at(-1)).toBe('public exported chunk 100')
+      expect(loadedOriginalBytes).toBeGreaterThan(0)
+      expect(loadedOriginalBytes).toBeLessThanOrEqual(originalBytes)
+    } finally {
+      measure.mockRestore()
+    }
+  })
+
+  it('keeps stored search totals and continuation while withholding only unsafe documents', async () => {
+    await seedDocument({ name: 'page-a.txt' })
+    await seedDocument({ name: 'page-b.txt', provenance: { status: 'unknown' } })
+    await seedDocument({ name: 'page-c.txt' })
+    const result = await inChat(() =>
+      listKnowledgeDocuments.execute({
+        principal,
+        input: {
+          knowledgeBaseId: ids.knowledgeBaseId,
+          search: 'page',
+          limit: 2,
+          sortBy: 'filename',
+          sortOrder: 'asc',
+        },
+      })
+    )
+    expect(result.documents.map((row) => row.filename)).toEqual(['page-a.txt'])
+    expect(result.pagination).toMatchObject({ total: 3, hasMore: true })
+  })
+
+  it('keeps chunk search totals and its next page when one matching chunk is withheld', async () => {
+    const doc = await seedDocument()
+    await seedChunk(doc.id, 1, 'page withheld content', { status: 'unknown' })
+    await seedChunk(doc.id, 2, 'page final content')
+    const result = await inChat(() =>
+      listKnowledgeChunks.execute({
+        principal,
+        input: {
+          knowledgeBaseId: ids.knowledgeBaseId,
+          documentId: doc.id,
+          search: 'page',
+          limit: 2,
+        },
+      })
+    )
+    expect(result.chunks.map((row) => row.content)).toEqual(['page public content'])
+    expect(result.pagination).toMatchObject({ total: 3, hasMore: true })
+    expect(result.nextCursorKeys).not.toBeNull()
+  })
+
+  it('returns ordinary aggregate counts while admitting detailed tag metadata per document', async () => {
+    const clean = await seedDocument()
+    await seedDocument({ provenance: { status: 'unknown' } })
+    const stats = await inChat(() =>
+      readKnowledgeTagUsage.execute({ principal, input: { knowledgeBaseId: ids.knowledgeBaseId } })
+    )
+    expect(stats.usage.find((row) => row.tagSlot === 'tag1')).toMatchObject({
+      documentCount: 2,
+      chunkCount: 2,
+    })
+    const detail = await inChat(() =>
+      readDetailedKnowledgeTagUsage.execute({
+        principal,
+        input: { knowledgeBaseId: ids.knowledgeBaseId },
+      })
+    )
+    expect(detail.usage[0].documents.map((row) => row.id)).toEqual([clean.id])
+  })
+
+  it.each(['tag1', 'filename'] as const)(
+    'binds captured chunk %s metadata to the row classified at delivery',
+    async (field) => {
+      const doc = await seedDocument()
+      const captured = {
+        id: doc.chunkId,
+        documentId: doc.id,
+        content: doc.content,
+        value: { content: doc.content, [field]: SECRET },
+      }
+      await db
+        .update(document)
+        .set({ [field]: SECRET })
+        .where(eq(document.id, doc.id))
+      const [secretRow] = await db.select().from(document).where(eq(document.id, doc.id))
+      await db.transaction((tx) =>
+        replaceKnowledgeDocumentSecretProvenanceInTx(
+          tx,
+          doc.id,
+          createKnowledgeDocumentSourceValue(secretRow),
+          bindKnowledgeDocumentFieldSecretProvenance(exact, field, SECRET)
+        )
+      )
+      const gate = createRegistryContentGate({
+        registry: new ResolvedSecretTraceRegistry([], {
+          userId: ids.aliceId,
+          workspaceId: ids.workspaceId,
+        }),
+        actorUserId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      expect(
+        await observeContentDelivery(gate, () => admitKnowledgeChunks(principal, [captured]))
+      ).toEqual(new Set([doc.chunkId]))
+      expect(gate.project?.(SECRET)).toBe('{{FIXTURE_TOKEN}}')
+      await db.transaction(async (tx) => {
+        const [current] = await tx
+          .update(document)
+          .set({ [field]: 'public' })
+          .where(eq(document.id, doc.id))
+          .returning()
+        await replaceKnowledgeDocumentSecretProvenanceInTx(
+          tx,
+          doc.id,
+          createKnowledgeDocumentSourceValue(current),
+          { status: 'exact', entries: [] }
+        )
+      })
+      expect(await inChat(() => admitKnowledgeChunks(principal, [captured]))).toEqual(new Set())
+    }
+  )
+
+  it('binds an original read to the captured storage key across a concurrent replacement', async () => {
+    const doc = await seedDocument({ original: false, content: SECRET, provenance: exact })
+    const oldKey = `kb/${generateId()}.txt`
+    const newKey = `kb/${generateId()}.txt`
+    for (const [key, content] of [
+      [oldKey, SECRET],
+      [newKey, 'replacement public content'],
+    ]) {
+      await uploadFile({
+        file: Buffer.from(content),
+        fileName: 'fixture.txt',
+        contentType: 'text/plain',
+        context: 'knowledge-base',
+        customKey: key,
+        preserveKey: true,
+        persistMetadata: false,
+      })
+    }
+    await db.update(document).set({ storageKey: oldKey }).where(eq(document.id, doc.id))
+    const input = {
+      knowledgeBaseId: ids.knowledgeBaseId,
+      documentId: doc.id,
+      assertedWorkspaceId: ids.workspaceId,
+    }
+    const matched = await inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+    expect(matched.buffer?.toString()).toBe(SECRET)
+    expect(matched.hasRecordedSecrets).toBe(true)
+    const resolve = knowledgeContexts.resolveCanonicalActiveKnowledgeDocumentContext
+    let replaced = false
+    const interleave = vi
+      .spyOn(knowledgeContexts, 'resolveCanonicalActiveKnowledgeDocumentContext')
+      .mockImplementation(async (...args) => {
+        const context = await resolve(...args)
+        await db.transaction(async (tx) => {
+          const [row] = await tx
+            .update(document)
+            .set({ storageKey: newKey })
+            .where(eq(document.id, doc.id))
+            .returning()
+          await replaceKnowledgeDocumentSecretProvenanceInTx(
+            tx,
+            doc.id,
+            createKnowledgeDocumentSourceValue(row),
+            { status: 'exact', entries: [] }
+          )
+        })
+        replaced = true
+        return context
+      })
+    try {
+      await expect(
+        inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+      ).rejects.toThrow(/provenance|model/i)
+      expect(replaced).toBe(true)
+    } finally {
+      interleave.mockRestore()
+    }
+    const current = await inChat(() => readOriginalKnowledgeDocument.execute({ principal, input }))
+    expect(current.buffer?.toString()).toBe('replacement public content')
+    expect(current.hasRecordedSecrets).toBe(false)
+  })
+
+  it('exports clean and legacy originals with chunks through the existing ZIP stream', async () => {
+    const docs = [
+      await seedDocument(),
+      await seedDocument({ name: 'tracked.txt', provenance: { status: 'exact', entries: [] } }),
+    ]
+    const bundle = await exportedBundle()
+    const zip = await JSZip.loadAsync(await archiveBytes(bundle))
+    for (const doc of docs) {
+      const original = Object.values(zip.files).find(
+        (file) => file.name.startsWith(`files/${doc.id}/`) && !file.dir
+      )
+      expect(await original?.async('string')).toBe(doc.content)
+      const lines = await zip.file(`chunks/${doc.id}.ndjson`)?.async('string')
+      expect(JSON.parse(lines?.trim() ?? '{}').content).toBe(doc.content)
+    }
+    expect(zip.file('manifest.json')).not.toBeNull()
+  })
+
+  it.each(['unknown', 'exact', 'corrupt'] as const)(
+    'refuses %s chunk bytes introduced after bundle creation, even outside the original gate context',
+    async (kind) => {
+      const doc = await seedDocument({ original: false })
+      const bundle = await exportedBundle()
+      await db.transaction(async (tx) => {
+        await tx
+          .update(embedding)
+          .set({ content: SECRET, chunkHash: sha256Hex(SECRET) })
+          .where(eq(embedding.id, doc.chunkId))
+        await replaceKnowledgeEmbeddingSecretProvenanceInTx(
+          tx,
+          doc.chunkId,
+          kind === 'corrupt' ? 'previous content' : SECRET,
+          kind === 'exact'
+            ? exact
+            : kind === 'unknown'
+              ? { status: 'unknown' }
+              : { status: 'exact', entries: [] }
+        )
+      })
+      await expect(archiveBytes(bundle)).rejects.toThrow(/provenance|model/i)
+      const emitted: string[] = []
+      await expect(
+        (async () => {
+          for await (const chunk of bundle.chunks(doc.id)) emitted.push(chunk.content)
+        })()
+      ).rejects.toThrow(/provenance|model/i)
+      expect(emitted).toEqual([])
+    }
+  )
+
+  it('refuses an inline original replaced after bundle creation without exposing new bytes', async () => {
+    const doc = await seedDocument()
+    const bundle = await exportedBundle()
+    await db.transaction(async (tx) => {
+      const [row] = await tx
+        .update(document)
+        .set({ fileUrl: `data:text/plain;base64,${Buffer.from(SECRET).toString('base64')}` })
+        .where(eq(document.id, doc.id))
+        .returning()
+      await replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        doc.id,
+        createKnowledgeDocumentSourceValue(row),
+        exact
+      )
+    })
+    await expect(archiveBytes(bundle)).rejects.toThrow(/provenance|model/i)
+  })
+
+  it('preserves authorized human export of the original and chunks', async () => {
+    const doc = await seedDocument({ content: SECRET, provenance: { status: 'unknown' } })
+    const zip = await JSZip.loadAsync(await archiveBytes(await exportedBundle(true)))
+    expect(await zip.file(`chunks/${doc.id}.ndjson`)?.async('string')).toContain(SECRET)
+    const original = Object.values(zip.files).find(
+      (file) => file.name.startsWith(`files/${doc.id}/`) && !file.dir
+    )
+    expect(await original?.async('string')).toBe(SECRET)
+  })
+})
diff --git a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
index 3f0fd094a10..fbe7e946692 100644
--- a/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts
@@ -24,6 +24,7 @@ import JSZip from 'jszip'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 
 const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+const embeddingInputs = vi.hoisted(() => new Map<string, string[]>())
 const sandboxEnvironment = vi.hoisted(() => {
   const fixture = {
     SANDBOX_PROVIDER: 'e2b',
@@ -45,18 +46,26 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
 vi.mock('@/lib/embeddings', async () => ({
   ...(await import('@/lib/embeddings/client')),
   assertKnowledgeEmbeddingCapacity: async () => {},
-  embedKnowledge: async (texts: string[]) => ({
-    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
-    totalTokens: texts.length,
-    billableTokens: 0,
-    isBYOK: true,
-    modelName: 'text-embedding-3-small',
-    pricingId: 'text-embedding-3-small',
-  }),
+  embedKnowledge: async (texts: string[], options: { workspaceId?: string | null }) => {
+    if (options.workspaceId) {
+      const inputs = embeddingInputs.get(options.workspaceId) ?? []
+      inputs.push(...texts)
+      embeddingInputs.set(options.workspaceId, inputs)
+    }
+    return {
+      embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+      totalTokens: texts.length,
+      billableTokens: 0,
+      isBYOK: true,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    }
+  },
 }))
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import { fileManageDecompressBodySchema } from '@/lib/api/contracts/tools/file'
+import { observeContentDelivery } from '@/lib/core/application'
 import { processOutboxEventById } from '@/lib/core/outbox/service'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { isUserFile } from '@/lib/core/utils/user-file'
@@ -76,16 +85,20 @@ import {
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { addWorkspaceFilesToKnowledgeBase } from '@/lib/knowledge/application/add-workspace-files'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
 import { searchKnowledge } from '@/lib/knowledge/application/search'
 import { KNOWLEDGE_DOCUMENT_PROCESSING_OUTBOX_EVENT } from '@/lib/knowledge/documents/processing-events'
 import { knowledgeDocumentProcessingOutboxHandlers } from '@/lib/knowledge/documents/processing-outbox-handler'
 import { createSingleDocument } from '@/lib/knowledge/documents/service'
 import { loadKnowledgeDocumentSecretRegistry } from '@/lib/knowledge/secret-provenance'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution/execution-file-manager'
 import {
   deleteWorkspaceFile,
   getWorkspaceFile,
+  uploadWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
   filterModelSafeWorkspaceFileAttachments,
@@ -190,13 +203,32 @@ async function extract(ids: Fixture, archive: UserFile) {
   return { child, record, identity, publicMetadata: JSON.stringify({ archive, body }) }
 }
 
-async function assertBlockedConsumers(ids: Fixture, source: Awaited<ReturnType<typeof extract>>) {
+/**
+ * Opaque delivery is refused either way. A knowledge base refuses an unknown source but accepts
+ * one with recorded secrets, whose entries its chunks then carry (redacted wherever they are read).
+ */
+async function assertBlockedConsumers(
+  ids: Fixture,
+  source: Awaited<ReturnType<typeof extract>>,
+  knowledge: 'refused' | 'accepted' = 'refused'
+) {
   expect(await isOpaqueWorkspaceFileEgressSafe(ids.workspaceId, source.identity)).toBe(false)
   const imported = await addWorkspaceFilesToKnowledgeBase.execute({
     principal: sessionPrincipal(ids),
     input: { knowledgeBaseId: ids.knowledgeBaseId, fileReferences: [source.child.id] },
   })
-  expect(imported).toMatchObject({ added: [], failed: [source.child.id] })
+  if (knowledge === 'refused') {
+    expect(imported).toMatchObject({ added: [], failed: [source.child.id] })
+  } else {
+    expect(imported).toMatchObject({ failed: [] })
+    expect(imported.added).toHaveLength(1)
+    /** The accepted document queued its processing; that work is removed with the fixture. */
+    const events = await db
+      .select({ id: outboxEvent.id })
+      .from(outboxEvent)
+      .where(sql`${outboxEvent.payload}::jsonb ->> 'documentId' = ${imported.added[0].documentId}`)
+    trackedEventIds.push(...events.map((event) => event.id))
+  }
 }
 
 beforeAll(() => {
@@ -696,6 +728,119 @@ describe('Function export provenance in PostgreSQL', () => {
 })
 
 describe('execution archive durable provenance', () => {
+  it.each([
+    {
+      name: 'whitespace-normalized secret',
+      secret: '  fixture-live-key-82367  ',
+      fragments: ['fixture-live-key-82367'],
+      masked: true,
+    },
+    {
+      name: 'secret crossing chunk boundaries',
+      secret: `left-fixture-secret-${'Q'.repeat(180)}-right-fixture-secret`,
+      fragments: ['left-fixture-secret', 'QQQQQQQQ', 'right-fixture-secret'],
+      masked: true,
+    },
+    { name: 'short secret cutoff', secret: 'T0k3n42', fragments: [], masked: false },
+  ])(
+    'indexes $name without changing original bytes or exposing derived fragments',
+    async (testCase) => {
+      const ids = await seed()
+      await db
+        .update(knowledgeBase)
+        .set({ chunkingConfig: { maxSize: 32, minSize: 1, overlap: 0 } })
+        .where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+      const { encrypted } = await encryptSecret(testCase.secret)
+      const content = `Public introduction.\n${testCase.secret}\nPublic conclusion.`
+      const source = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(content),
+        'source.txt',
+        'text/plain',
+        {
+          notifyWorkspaceChange: false,
+          secretProvenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'FIXTURE_SECRET',
+                encryptedValue: encrypted,
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+              },
+            ],
+          },
+        }
+      )
+      const imported = await addWorkspaceFilesToKnowledgeBase.execute({
+        principal: sessionPrincipal(ids),
+        input: { knowledgeBaseId: ids.knowledgeBaseId, fileReferences: [source.id] },
+      })
+      expect(imported.failed).toEqual([])
+      expect(imported.added).toHaveLength(1)
+      const documentId = imported.added[0].documentId
+      const events = await db
+        .select()
+        .from(outboxEvent)
+        .where(sql`${outboxEvent.payload}::jsonb ->> 'documentId' = ${documentId}`)
+      trackedEventIds.push(...events.map((event) => event.id))
+      const dispatch = events.find(
+        (event) => event.eventType === KNOWLEDGE_DOCUMENT_PROCESSING_OUTBOX_EVENT
+      )
+      if (!dispatch) throw new Error('Knowledge import did not queue document processing')
+      await processOutboxEventById(dispatch.id, knowledgeDocumentProcessingOutboxHandlers)
+      const [indexed] = await db.select().from(document).where(eq(document.id, documentId))
+      expect(indexed.processingStatus, indexed.processingError ?? undefined).toBe('completed')
+      if (!indexed.storageKey) throw new Error('Knowledge import did not retain its original')
+      expect(
+        (await downloadFile({ key: indexed.storageKey, context: 'knowledge-base' })).toString()
+      ).toBe(content)
+      const stored = await listKnowledgeChunks.execute({
+        principal: sessionPrincipal(ids),
+        input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+      })
+      const readbackRegistry = new ResolvedSecretTraceRegistry([], {
+        userId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      const gate = createRegistryContentGate({
+        registry: readbackRegistry,
+        actorUserId: ids.aliceId,
+        workspaceId: ids.workspaceId,
+      })
+      const readback = await observeContentDelivery(gate, () =>
+        listKnowledgeChunks.execute({
+          principal: createCopilotChatPrincipal(
+            { userId: ids.aliceId, workspaceId: ids.workspaceId },
+            KNOWLEDGE_DELEGATION_AUDIENCE
+          ),
+          input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+        })
+      )
+      expect(readback.chunks.length).toBeGreaterThan(0)
+      const projected = projectResolvedSecretModelContent(readback, readbackRegistry)
+      expect(projected.safe).toBe(true)
+      if (!projected.safe) throw new Error('Indexed chunk readback was withheld')
+      const outputs = [
+        (embeddingInputs.get(ids.workspaceId) ?? []).join('\n'),
+        stored.chunks.map((chunk) => chunk.content).join('\n'),
+        JSON.stringify(projected.value),
+      ]
+      for (const output of outputs) {
+        expect(output).toContain('Public introduction.')
+        expect(output).toContain('Public conclusion.')
+        if (testCase.masked) {
+          expect(output).toContain('{{FIXTURE_SECRET}}')
+          for (const fragment of testCase.fragments) expect(output).not.toContain(fragment)
+        } else {
+          expect(output).toContain(testCase.secret)
+          expect(output).not.toContain('{{FIXTURE_SECRET}}')
+        }
+      }
+    }
+  )
+
   it.each(['exact', 'unrecorded'] as const)(
     'carries %s lineage through extraction and delayed KB indexing/search',
     async (status) => {
@@ -827,7 +972,7 @@ describe('execution archive durable provenance', () => {
     expect(projected.safe).toBe(true)
     if (!projected.safe) throw new Error('Known extracted lineage withheld runtime readback')
     expect(projected.value).toBe('name,description\nOrion,{{FIXTURE_SECRET}}\n')
-    await assertBlockedConsumers(ids, source)
+    await assertBlockedConsumers(ids, source, 'accepted')
   })
 
   it('preserves compatibility for execution files created before provenance stamping', async () => {
diff --git a/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts b/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
index 72b0687f2cb..d44f0fc0267 100644
--- a/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts
@@ -101,7 +101,6 @@ async function readUpload(ids: Awaited<ReturnType<typeof seedUpload>>) {
       workspaceId: ids.workspaceId,
       chatId: ids.chatId,
       reference: `uploads/${ids.name}`,
-      includeSecretProvenance: true,
     },
   })
   return {
diff --git a/apps/sim/lib/knowledge/application/add-workspace-files.ts b/apps/sim/lib/knowledge/application/add-workspace-files.ts
index 241d463f469..36ac1b65c9a 100644
--- a/apps/sim/lib/knowledge/application/add-workspace-files.ts
+++ b/apps/sim/lib/knowledge/application/add-workspace-files.ts
@@ -37,6 +37,8 @@ import {
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
   getBoundWorkspaceFileSecretProvenance,
+  mergeWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenanceIdentity,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import {
@@ -81,7 +83,7 @@ interface AddWorkspaceFilesContext extends ActiveKnowledgeBaseContext {
 interface PreparedWorkspaceFile {
   reference: string
   file: WorkspaceFileRecord
-  unrecordedProvenance: boolean
+  provenance: WorkspaceFileSecretProvenance
 }
 
 async function prepareWorkspaceFile(
@@ -111,7 +113,7 @@ async function prepareWorkspaceFile(
   const fileTypeError = validateFileType(file.name, file.type)
   if (fileTypeError) throw new OrchestrationError('validation', fileTypeError.message)
 
-  const unrecordedProvenance = await assertImportProvenance(context.workspaceId, {
+  const provenance = await readImportProvenance(context.workspaceId, {
     fileId: file.id,
     key: file.key,
     context: file.storageContext ?? 'workspace',
@@ -121,25 +123,27 @@ async function prepareWorkspaceFile(
   return {
     reference,
     file,
-    unrecordedProvenance,
+    provenance,
   }
 }
 
-async function assertImportProvenance(
+/**
+ * The provenance a source file brings into the document. Its secret entries carry over to the
+ * document's content, and from there to each chunk that holds them, so reads redact them; only a
+ * source whose provenance is unknown is refused, since nothing could be carried for it.
+ */
+async function readImportProvenance(
   workspaceId: string,
   identity: WorkspaceFileSecretProvenanceIdentity
-): Promise<boolean> {
+): Promise<WorkspaceFileSecretProvenance> {
   const provenance = await getBoundWorkspaceFileSecretProvenance(workspaceId, identity)
-  if (
-    provenance.status === 'unknown' ||
-    (provenance.status === 'exact' && provenance.entries.length > 0)
-  ) {
+  if (provenance.status === 'unknown') {
     throw new OrchestrationError(
       'validation',
       'Workspace file secret provenance prevents knowledge ingestion'
     )
   }
-  return provenance.status === 'unrecorded'
+  return provenance
 }
 
 export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase({
@@ -221,7 +225,7 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         const requestId = generateRequestId()
         const current = await prepareWorkspaceFile(principal, context, candidate.file.id, 'id')
         const unrecordedSources = new Set<string>()
-        if (current.unrecordedProvenance) unrecordedSources.add(current.file.id)
+        const sourceProvenance: WorkspaceFileSecretProvenance[] = []
         const readSignal = AbortSignal.timeout(SOURCE_READ_TIMEOUT_MS)
         const signal = input.cancellationSignal
           ? AbortSignal.any([readSignal, input.cancellationSignal])
@@ -244,9 +248,9 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         }
         for (const identity of contributors) {
           signal.throwIfAborted()
-          if (await assertImportProvenance(context.workspaceId, identity)) {
-            unrecordedSources.add(identity.fileId)
-          }
+          const provenance = await readImportProvenance(context.workspaceId, identity)
+          if (provenance.status === 'unrecorded') unrecordedSources.add(identity.fileId)
+          sourceProvenance.push(provenance)
         }
         const documentId = generateId()
         const storedFile = await uploadKnowledgeArtifact({
@@ -274,7 +278,17 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
         ) {
           throw new OrchestrationError('conflict', 'Workspace file changed during knowledge import')
         }
-        if (finalized.unrecordedProvenance) unrecordedSources.add(finalized.file.id)
+        if (finalized.provenance.status === 'unrecorded') unrecordedSources.add(finalized.file.id)
+        const content = mergeWorkspaceFileSecretProvenance(
+          finalized.provenance,
+          ...sourceProvenance
+        )
+        if (content.status === 'unknown') {
+          throw new OrchestrationError(
+            'validation',
+            'Workspace file secret provenance prevents knowledge ingestion'
+          )
+        }
         input.cancellationSignal?.throwIfAborted()
         const document = await createSingleDocument(
           {
@@ -289,7 +303,7 @@ export const addWorkspaceFilesToKnowledgeBase = defineAuthorizedKnowledgeUseCase
           documentId,
           {
             filename: { status: 'exact', entries: [] },
-            content: { status: 'exact', entries: [] },
+            content: content.status === 'exact' ? content : { status: 'exact', entries: [] },
             tags: [],
           },
           {
diff --git a/apps/sim/lib/knowledge/application/admit-knowledge-content.ts b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
new file mode 100644
index 00000000000..736322e5cdf
--- /dev/null
+++ b/apps/sim/lib/knowledge/application/admit-knowledge-content.ts
@@ -0,0 +1,91 @@
+import type { Principal } from '@sim/auth/principal'
+import { admitEach, type ContentSourceKind } from '@/lib/core/application'
+import {
+  classifyKnowledgeChunks,
+  classifyKnowledgeDocumentMetadata,
+  type KnowledgeDocumentSnapshot,
+  knowledgeDocumentSnapshot,
+} from '@/lib/knowledge/secret-provenance'
+
+interface KnowledgeAdmissionOptions {
+  /** The items are what a committed write returns; see `admitWrittenContent`. */
+  written?: boolean
+}
+
+const writtenAs = (options: KnowledgeAdmissionOptions, kind: ContentSourceKind) =>
+  options.written ? { written: kind } : {}
+
+/**
+ * Admits each document whose rendered metadata a result returns, on its own, and returns the ids
+ * admitted. `value` is what the result shows of the document, so only secrets it contains are
+ * imported; `snapshot` names the stored fields it shows, when they are not its own keys. A caller
+ * no gate observes gets every id back without a provenance read.
+ */
+export async function admitKnowledgeDocuments(
+  principal: Principal,
+  documents: readonly { id: string; value: unknown; snapshot?: KnowledgeDocumentSnapshot }[],
+  options: KnowledgeAdmissionOptions = {}
+): Promise<Set<string>> {
+  const admitted = await admitEach(
+    principal,
+    documents,
+    async (items) => {
+      /** Each classification is bound to the metadata the item shows; see the classifier. */
+      const snapshots = new Map<string, KnowledgeDocumentSnapshot[]>()
+      for (const item of items) {
+        const snapshot = item.snapshot ?? knowledgeDocumentSnapshot(item.value)
+        if (snapshot) snapshots.set(item.id, [...(snapshots.get(item.id) ?? []), snapshot])
+      }
+      const provenance = await classifyKnowledgeDocumentMetadata(
+        items.map((item) => item.id),
+        snapshots
+      )
+      return items.map((item) => ({
+        kind: 'knowledge-document' as const,
+        id: item.id,
+        provenance: provenance.get(item.id) ?? { status: 'unknown' as const },
+        view: { derived: item.value },
+      }))
+    },
+    writtenAs(options, 'knowledge-document')
+  )
+  return new Set(admitted.map((item) => item.id))
+}
+
+/**
+ * Admits each chunk a result returns, on its own: its content's provenance merged with that of the
+ * document whose metadata it carries. `value` is what the result shows of the chunk; without one,
+ * every secret the chunk and its document can hold counts. Returns the ids admitted.
+ */
+export async function admitKnowledgeChunks(
+  principal: Principal,
+  chunks: readonly {
+    id: string
+    documentId: string
+    content: string
+    value?: unknown
+    snapshot?: KnowledgeDocumentSnapshot
+  }[],
+  options: KnowledgeAdmissionOptions = {}
+): Promise<Set<string>> {
+  const admitted = await admitEach(
+    principal,
+    chunks,
+    async (items) => {
+      const provenance = await classifyKnowledgeChunks(
+        items.map((chunk) => ({
+          ...chunk,
+          snapshot: chunk.snapshot ?? knowledgeDocumentSnapshot(chunk.value ?? chunk),
+        }))
+      )
+      return items.map((chunk) => ({
+        kind: 'knowledge-chunk' as const,
+        id: chunk.id,
+        provenance: provenance.get(chunk.id) ?? { status: 'unknown' as const },
+        view: chunk.value === undefined ? ('complete' as const) : { derived: chunk.value },
+      }))
+    },
+    writtenAs(options, 'knowledge-chunk')
+  )
+  return new Set(admitted.map((chunk) => chunk.id))
+}
diff --git a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
index ef5c7b98d1f..12a902ac374 100644
--- a/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
+++ b/apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts
@@ -5,6 +5,7 @@ import {
   type PrincipalForOperation,
   recordProjectedUseCaseAuditEntries,
   requireAllowedWorkspacePrincipal,
+  runDeclaredContentOperation,
   type WorkspaceUseCaseAuditEntry,
 } from '@/lib/core/application'
 import { authorizeOrganizationOperation } from '@/lib/core/application/organization-authorization'
@@ -234,13 +235,18 @@ export function defineAuthorizedKnowledgeUseCase<
         context: resolved.context,
         request,
       }
-      return runWithOutboundOrganization(resolved.context.organizationId, async () => {
-        const result = await definition.execute(executionContext)
-        const resultContext = { ...executionContext, result }
-        recordOrganizationAudit(resultContext, resolved.context.organizationId)
-        await definition.afterSuccess?.(resultContext)
-        return result
-      })
+      return runWithOutboundOrganization(resolved.context.organizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          resolved.principal,
+          () => definition.execute(executionContext),
+          async (result) => {
+            const resultContext = { ...executionContext, result }
+            recordOrganizationAudit(resultContext, resolved.context.organizationId)
+            await definition.afterSuccess?.(resultContext)
+          }
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/knowledge/application/chunks.test.ts b/apps/sim/lib/knowledge/application/chunks.test.ts
index 5b7121d60f4..1475f02f69e 100644
--- a/apps/sim/lib/knowledge/application/chunks.test.ts
+++ b/apps/sim/lib/knowledge/application/chunks.test.ts
@@ -1,3 +1,4 @@
+import type { Principal } from '@sim/auth/principal'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import {
   knowledgeContextsMock,
@@ -8,6 +9,7 @@ import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/wo
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  admitKnowledgeChunks: vi.fn(),
   queryChunks: vi.fn(),
   batchChunkOperation: vi.fn(),
   createChunk: vi.fn(),
@@ -36,10 +38,19 @@ vi.mock('@/lib/knowledge/model-input-provenance', () => ({
 
 vi.mock('@/providers/utils', () => providersUtilsMock)
 
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => ({
+  admitKnowledgeChunks: mocks.admitKnowledgeChunks,
+}))
+
+import { admitContent } from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
-import { bulkUpdateKnowledgeChunks, listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import {
+  bulkUpdateKnowledgeChunks,
+  createKnowledgeChunk,
+  listKnowledgeChunks,
+} from '@/lib/knowledge/application/chunks'
 
 describe('knowledge chunk application use cases', () => {
   beforeEach(() => {
@@ -57,6 +68,45 @@ describe('knowledge chunk application use cases', () => {
     })
   })
 
+  /** Stands in for the gate's verdicts; accounting is the real primitive's, as the helper's is. */
+  function admitOnly(ids: string[]) {
+    mocks.admitKnowledgeChunks.mockImplementation(async (principal: Principal) => {
+      await admitContent(principal, [])
+      return new Set(ids)
+    })
+  }
+
+  it('admits a created chunk with the document name its response shows', async () => {
+    workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('write')
+    knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'billing-owner-1',
+      access: { get: async () => WORKSPACE_ACCESS_SCOPE },
+      knowledgeBaseId: 'knowledge-1',
+      knowledgeBase: { id: 'knowledge-1', embeddingModel: 'text-embedding-3-small' },
+      documentId: 'document-1',
+      document: { id: 'document-1', processingStatus: 'completed', filename: 'named.txt' },
+    })
+    mocks.createChunk.mockResolvedValue({ id: 'chunk-new', content: 'body', tokenCount: 1 })
+    admitOnly(['chunk-new'])
+
+    const result = await createKnowledgeChunk.execute({
+      principal: createSessionPrincipal(),
+      input: {
+        knowledgeBaseId: 'knowledge-1',
+        documentId: 'document-1',
+        content: 'body',
+        resolveContentProvenance: () => undefined,
+      },
+    })
+
+    expect(result.chunk.documentName).toBe('named.txt')
+    const [, [item]] = mocks.admitKnowledgeChunks.mock.calls[0]
+    expect(item.value).toMatchObject({ documentId: 'document-1', documentName: 'named.txt' })
+  })
+
   it('returns a typed transient failure before querying chunks for a processing document', async () => {
     const promise = listKnowledgeChunks.execute({
       principal: createSessionPrincipal(),
diff --git a/apps/sim/lib/knowledge/application/chunks.ts b/apps/sim/lib/knowledge/application/chunks.ts
index fd2f5774014..719f87d56ed 100644
--- a/apps/sim/lib/knowledge/application/chunks.ts
+++ b/apps/sim/lib/knowledge/application/chunks.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
+import { ContentRefusedError } from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -8,6 +9,7 @@ import {
   type DurableSecretProvenance,
 } from '@/lib/execution/durable-secret-provenance'
 import { reportDurableSecretProvenanceRefusal } from '@/lib/execution/durable-secret-provenance-telemetry'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveKnowledgeAttributedUserId } from '@/lib/knowledge/application/billing'
 import { KnowledgeDocumentNotReadyError } from '@/lib/knowledge/application/chunk-errors'
@@ -26,6 +28,7 @@ import {
 } from '@/lib/knowledge/chunks/service'
 import type { ChunkFilters } from '@/lib/knowledge/chunks/types'
 import { runWithKnowledgeModelInputProvenance } from '@/lib/knowledge/model-input-provenance'
+import type { KnowledgeDocumentSnapshot } from '@/lib/knowledge/secret-provenance'
 import { calculateCost } from '@/providers/utils'
 
 const logger = createLogger('KnowledgeChunkApplication')
@@ -65,6 +68,30 @@ export interface BulkKnowledgeChunksInput extends KnowledgeDocumentChunkInput {
   chunkIds: string[]
 }
 
+/**
+ * One chunk a result returns. A read is refused on its own when its gate refuses it; a committed
+ * write completes and then answers with the refusal (see `admitWrittenContent`).
+ */
+async function requireAdmittedChunk(
+  principal: Principal,
+  documentId: string,
+  chunk: { id: string; content: string },
+  options: {
+    written?: boolean
+    shown?: Record<string, unknown>
+    snapshot?: KnowledgeDocumentSnapshot
+  } = {}
+): Promise<void> {
+  /** `shown` is every other field the response adds beside the chunk, such as its document name. */
+  const value = options.shown ? { ...chunk, ...options.shown } : chunk
+  const admitted = await admitKnowledgeChunks(
+    principal,
+    [{ id: chunk.id, documentId, content: chunk.content, value, snapshot: options.snapshot }],
+    { written: options.written }
+  )
+  if (!options.written && !admitted.has(chunk.id)) throw new ContentRefusedError('knowledge-chunk')
+}
+
 function requireChunkReadable(context: ActiveKnowledgeDocumentContext): void {
   if (context.document.processingStatus !== 'completed') {
     throw new KnowledgeDocumentNotReadyError(context.document.processingStatus)
@@ -112,7 +139,7 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ListKnowledgeChunksInput
   }) => resolveCanonicalActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     if (input.requireEnabledDocument && !context.document.enabled) {
       throw new OrchestrationError('not_found', 'Document not found')
     }
@@ -130,7 +157,22 @@ export const listKnowledgeChunks = defineAuthorizedKnowledgeUseCase({
       generateRequestId(),
       await context.access.get()
     )
-    return { ...result, workspaceId: context.workspaceId, documentId }
+    const admitted = await admitKnowledgeChunks(
+      principal,
+      result.chunks.map((chunk) => ({
+        id: chunk.id,
+        documentId,
+        content: chunk.content,
+        value: chunk,
+      }))
+    )
+    const chunks = result.chunks.filter((chunk) => admitted.has(chunk.id))
+    return {
+      ...result,
+      chunks,
+      workspaceId: context.workspaceId,
+      documentId,
+    }
   },
 })
 
@@ -138,8 +180,9 @@ export const readKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readChunk,
   resolveContext: ({ principal, input }: { principal: Principal; input: KnowledgeChunkInput }) =>
     resolveActiveKnowledgeChunkContext(input, principal),
-  async execute({ context }) {
+  async execute({ principal, context }) {
     requireChunkReadable(context)
+    await requireAdmittedChunk(principal, context.documentId, context.chunk)
     return {
       chunk: context.chunk,
       workspaceId: context.workspaceId,
@@ -196,6 +239,11 @@ export const createKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
     } catch (error) {
       logger.warn('Failed to calculate cost for chunk upload', { error })
     }
+    await requireAdmittedChunk(principal, context.documentId, chunk, {
+      written: true,
+      shown: { documentId: context.documentId, documentName: context.document.filename },
+      snapshot: { filename: context.document.filename },
+    })
     return {
       chunk: {
         ...chunk,
@@ -259,6 +307,7 @@ export const updateKnowledgeChunk = defineAuthorizedKnowledgeUseCase({
         provenance
       )
     )
+    await requireAdmittedChunk(principal, context.documentId, chunk, { written: true })
     return { chunk, workspaceId: context.workspaceId, documentId: context.documentId }
   },
 })
diff --git a/apps/sim/lib/knowledge/application/connectors.ts b/apps/sim/lib/knowledge/application/connectors.ts
index aee24d4ba78..b60670c0b40 100644
--- a/apps/sim/lib/knowledge/application/connectors.ts
+++ b/apps/sim/lib/knowledge/application/connectors.ts
@@ -35,6 +35,7 @@ import { parseExactEnvironmentReference } from '@/lib/environment/reference'
 import { resolveEffectiveEnvironmentVariables } from '@/lib/environment/utils'
 import { requireKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availability'
 import { knowledgeAccessCondition } from '@/lib/knowledge/access/predicate'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   resolveKnowledgeAttributedUserId,
@@ -1190,7 +1191,7 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
     principal: Principal
     input: ListKnowledgeConnectorDocumentsInput
   }) => resolveActiveKnowledgeConnectorContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     const limit = input.limit ?? DEFAULT_KNOWLEDGE_CONNECTOR_DOCUMENT_PAGE_SIZE
     const offset = input.offset ?? 0
     if (
@@ -1218,15 +1219,16 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
     }
     const filter =
       input.filter ?? (input.failedOnly ? 'failed' : input.includeExcluded ? undefined : 'active')
-    const baseConditions = [
+    const scopeConditions = [
       eq(document.connectorId, context.connectorId),
       isNull(document.archivedAt),
       isNull(document.deletedAt),
       knowledgeAccessCondition(await context.access.get()),
-      search
-        ? sql`${document.filename} ILIKE ${`%${escapeLikePattern(search)}%`} ESCAPE '\\'`
-        : undefined,
     ] as const
+    const searchCondition = search
+      ? sql`${document.filename} ILIKE ${`%${escapeLikePattern(search)}%`} ESCAPE '\\'`
+      : undefined
+    const baseConditions = [...scopeConditions, searchCondition] as const
     const active = sql`${document.userExcluded} = false`
     /** One pass over the source's readable documents; excluded rows are scanned only when counted. */
     const [[counts], rows] = await Promise.all([
@@ -1260,9 +1262,13 @@ export const listKnowledgeConnectorDocuments = defineAuthorizedKnowledgeUseCase(
         .offset(offset),
     ])
     const hasMore = rows.length > limit
-    const documents = rows.slice(0, limit)
+    const page = rows.slice(0, limit)
+    const admitted = await admitKnowledgeDocuments(
+      principal,
+      page.map((row) => ({ id: row.id, value: row }))
+    )
     return {
-      documents,
+      documents: page.filter((row) => admitted.has(row.id)),
       counts: {
         active: counts?.active ?? 0,
         excluded: counts?.excluded ?? 0,
diff --git a/apps/sim/lib/knowledge/application/documents.test.ts b/apps/sim/lib/knowledge/application/documents.test.ts
index 31ceaca2b64..25761ec99b6 100644
--- a/apps/sim/lib/knowledge/application/documents.test.ts
+++ b/apps/sim/lib/knowledge/application/documents.test.ts
@@ -68,6 +68,27 @@ vi.mock('@/lib/uploads/server/metadata', () => uploadsMetadataMock)
 
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 
+/** Chat's verdicts come from a stand-in gate (refusing `withheld-*` ids); other callers run the real helper. */
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import('@/lib/knowledge/application/admit-knowledge-content')>()
+  const delivery =
+    await vi.importActual<typeof import('@/lib/core/application')>('@/lib/core/application')
+  return {
+    ...original,
+    admitKnowledgeDocuments: async (
+      principal: Parameters<typeof original.admitKnowledgeDocuments>[0],
+      documents: Parameters<typeof original.admitKnowledgeDocuments>[1]
+    ) => {
+      if (!delivery.isCopilotPrincipal(principal)) {
+        return original.admitKnowledgeDocuments(principal, documents)
+      }
+      await delivery.admitContent(principal, [])
+      return new Set(documents.map((doc) => doc.id).filter((id) => !id.startsWith('withheld-')))
+    },
+  }
+})
+
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import {
diff --git a/apps/sim/lib/knowledge/application/documents.ts b/apps/sim/lib/knowledge/application/documents.ts
index 6a29c50085f..300ecfb3640 100644
--- a/apps/sim/lib/knowledge/application/documents.ts
+++ b/apps/sim/lib/knowledge/application/documents.ts
@@ -8,9 +8,14 @@ import {
   type BillingAttributionSnapshot,
   checkAttributedUsageLimits,
 } from '@/lib/billing/core/billing-attribution'
-import { authorizeWorkspaceOperation } from '@/lib/core/application'
+import {
+  admitContent,
+  authorizeWorkspaceOperation,
+  ContentRefusedError,
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { knowledgeDelegationPolicy } from '@/lib/knowledge/application/authorization'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
@@ -257,6 +262,25 @@ export interface UpsertKnowledgeDocumentInput extends UploadKnowledgeDocumentAdm
  * so a presenter can key each document's tag values by display name — the same
  * projection knowledge search performs — without reading protected data itself.
  */
+/**
+ * One document a result returns. A read is refused on its own when its gate refuses its metadata;
+ * a committed write completes and then answers with the refusal (see `admitWrittenContent`).
+ */
+async function requireAdmittedDocument(
+  principal: Principal,
+  document: { id: string },
+  options: { written?: boolean } = {}
+): Promise<void> {
+  const admitted = await admitKnowledgeDocuments(
+    principal,
+    [{ id: document.id, value: document }],
+    options
+  )
+  if (!options.written && !admitted.has(document.id)) {
+    throw new ContentRefusedError('knowledge-document')
+  }
+}
+
 export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.listDocuments,
   resolveContext: ({
@@ -266,7 +290,7 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ListKnowledgeDocumentsInput
   }) => resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     const limit = input.limit ?? 50
     const offset = input.offset ?? 0
     if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
@@ -298,8 +322,14 @@ export const listKnowledgeDocuments = defineAuthorizedKnowledgeUseCase({
       generateRequestId(),
       context.access
     )
+    const admitted = await admitKnowledgeDocuments(
+      principal,
+      result.documents.map((doc) => ({ id: doc.id, value: doc }))
+    )
+    const documents = result.documents.filter((doc) => admitted.has(doc.id))
     return {
       ...result,
+      documents,
       tagDefinitions:
         resolvedNameFilters?.definitionsByKnowledgeBase.get(context.knowledgeBaseId) ??
         (await getDocumentTagDefinitions(context.knowledgeBaseId)),
@@ -317,10 +347,11 @@ export const readKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ReadKnowledgeDocumentInput
   }) => resolveActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ principal, input, context }) {
     if (input.requireEnabledDocument && !context.document.enabled) {
       throw new OrchestrationError('not_found', 'Document not found')
     }
+    await requireAdmittedDocument(principal, context.document)
     return {
       document: context.document,
       tagDefinitions: await getDocumentTagDefinitions(context.knowledgeBaseId),
@@ -828,6 +859,7 @@ export const updateKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
         }
         throw new OrchestrationError(outcome.errorCode, outcome.error)
       }
+      await admitContent(principal, [])
       return {
         kind: 'processing' as const,
         documentId: context.documentId,
@@ -853,9 +885,11 @@ export const updateKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     if (updatedFields.length === 0) {
       throw new OrchestrationError('validation', 'No updates specified')
     }
+    const document = await updateDocument(context.documentId, updates, generateRequestId())
+    await requireAdmittedDocument(principal, document, { written: true })
     return {
       kind: 'updated' as const,
-      document: await updateDocument(context.documentId, updates, generateRequestId()),
+      document,
       tagDefinitions: await getDocumentTagDefinitions(context.knowledgeBaseId),
       updatedFields,
     }
diff --git a/apps/sim/lib/knowledge/application/exports.ts b/apps/sim/lib/knowledge/application/exports.ts
index 646374f806c..38bb7054702 100644
--- a/apps/sim/lib/knowledge/application/exports.ts
+++ b/apps/sim/lib/knowledge/application/exports.ts
@@ -1,10 +1,23 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import type { Readable } from 'node:stream'
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  ContentRefusedError,
+  mustClassifyContent,
+  requireAdmittedContent,
+} from '@/lib/core/application'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveActiveKnowledgeBaseContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { KNOWLEDGE_BUNDLE_VERSION } from '@/lib/knowledge/constants'
 import { toKbEmbeddingDimensions } from '@/lib/knowledge/embedding-models'
+import {
+  classifyKnowledgeChunkContent,
+  classifyKnowledgeDocumentMetadata,
+  loadKnowledgeDocumentDurableSecretProvenance,
+} from '@/lib/knowledge/secret-provenance'
 import {
   bundleEntryPaths,
   type KnowledgeBundleManifest,
@@ -12,6 +25,7 @@ import {
   parseDescribableBundle,
   toManifestDocument,
 } from '@/lib/knowledge/transfer/bundle'
+import { openKnowledgeExportFile } from '@/lib/knowledge/transfer/export-archive'
 import {
   type ExportableChunk,
   type ExportableDocument,
@@ -38,6 +52,7 @@ export interface KnowledgeBaseExportBundle {
   embedding: KnowledgeBundleManifest['embedding']
   tags: KnowledgeBundleTag[]
   documents: ExportableDocument[]
+  file(document: ExportableDocument): Promise<Readable | Buffer>
   chunks(documentId: string): AsyncIterable<ExportableChunk>
 }
 
@@ -50,13 +65,22 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ExportKnowledgeBaseInput
   }) => resolveActiveKnowledgeBaseContext(input, principal),
-  async execute({ input, context }): Promise<KnowledgeBaseExportBundle> {
+  async execute({ principal, input, context }): Promise<KnowledgeBaseExportBundle> {
     const { knowledgeBase } = context
     const dimension = toKbEmbeddingDimensions(knowledgeBase.embeddingDimension)
     const [tags, documents] = await Promise.all([
       listExportableTags(knowledgeBase.id),
       listExportableDocuments(knowledgeBase.id),
     ])
+    const classify = mustClassifyContent(principal)
+    const inExportContext = AsyncLocalStorage.snapshot()
+    const documentById = new Map(documents.map((document) => [document.id, document]))
+    const snapshot = (document: ExportableDocument) => ({
+      filename: document.filename,
+      ...document.tags,
+    })
+    // Deferred bytes are admitted in the captured context as their stream reaches each source.
+    await admitContent(principal, [])
     const manifest = parseDescribableBundle({
       version: KNOWLEDGE_BUNDLE_VERSION,
       exportedAt: new Date().toISOString(),
@@ -80,8 +104,69 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
       embedding: manifest.embedding,
       tags: manifest.tags,
       documents,
-      chunks: (documentId) =>
-        iterateDocumentChunks(knowledgeBase.id, documentId, input.vectors ? dimension : null),
+      file: (document) =>
+        inExportContext(async () => {
+          if (!document.file) throw new ContentRefusedError('knowledge-document')
+          if (!classify) return openKnowledgeExportFile(document.file)
+          const current = await loadKnowledgeDocumentDurableSecretProvenance(
+            document.id,
+            snapshot(document)
+          )
+          if (
+            current.knowledgeBaseId !== knowledgeBase.id ||
+            (document.file.kind === 'storage' && current.storageKey !== document.file.key) ||
+            (document.file.kind === 'data-uri' && current.storageKey !== null)
+          ) {
+            throw new ContentRefusedError('knowledge-document')
+          }
+          await requireAdmittedContent(principal, {
+            kind: 'knowledge-document',
+            id: document.id,
+            provenance: current.provenance,
+            view: 'opaque',
+          })
+          return openKnowledgeExportFile(document.file, current.source.fileUrl)
+        }),
+      chunks: async function* (documentId) {
+        const document = documentById.get(documentId)
+        if (!document) throw new ContentRefusedError('knowledge-document')
+        if (classify) {
+          await inExportContext(async () => {
+            const provenance = await classifyKnowledgeDocumentMetadata(
+              [documentId],
+              new Map([[documentId, [snapshot(document)]]])
+            )
+            await requireAdmittedContent(principal, {
+              kind: 'knowledge-document',
+              id: documentId,
+              provenance: provenance.get(documentId) ?? { status: 'unknown' },
+              view: 'opaque',
+            })
+          })
+        }
+        yield* iterateDocumentChunks(
+          knowledgeBase.id,
+          documentId,
+          input.vectors ? dimension : null,
+          classify
+            ? (page) =>
+                inExportContext(async () => {
+                  const provenance = await classifyKnowledgeChunkContent(
+                    page.map((chunk) => ({ ...chunk, documentId }))
+                  )
+                  const sources = page.map((chunk) => ({
+                    kind: 'knowledge-chunk' as const,
+                    id: chunk.id,
+                    provenance: provenance.get(chunk.id) ?? { status: 'unknown' as const },
+                    view: 'opaque' as const,
+                  }))
+                  if ((await admitContent(principal, sources)).refused.length > 0) {
+                    throw new ContentRefusedError('knowledge-chunk')
+                  }
+                })
+            : undefined
+        )
+      },
     }
   },
   projectAudit: ({ context, input, result }) => ({
diff --git a/apps/sim/lib/knowledge/application/operations.ts b/apps/sim/lib/knowledge/application/operations.ts
index 28202ce3788..b3f3cc58ad6 100644
--- a/apps/sim/lib/knowledge/application/operations.ts
+++ b/apps/sim/lib/knowledge/application/operations.ts
@@ -66,6 +66,8 @@ function defineKnowledgeOperation<const O extends WorkspaceOperation>(
           delegationAudience: options?.organizationDelegationAudience ?? 'sim:knowledge',
           delegatedServices:
             operation.id === 'knowledge.search' ? ['copilot', 'slack-search'] : ['copilot'],
+          /** Chat reaches the organization form through the same use case, under one declaration. */
+          contentDelivery: operation.contentDelivery ?? 'none',
         } as const)
       : ({ principalKinds: ['session', 'personal_api_key', 'oauth_access_token'] } as const)),
   })
@@ -275,6 +277,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -285,6 +288,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -300,6 +304,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.export',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -315,6 +320,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.create',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -325,6 +331,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -335,6 +342,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -352,6 +360,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -362,6 +371,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -372,6 +382,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -382,6 +393,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -392,6 +404,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -402,6 +415,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     }),
     /** Folder mentions resolve workspace folders; organization delegation stays disabled. */
@@ -414,6 +428,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -424,6 +439,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -434,6 +450,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -444,6 +461,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -454,6 +472,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -470,6 +489,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -480,6 +500,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -490,6 +511,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -500,6 +522,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -510,6 +533,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -520,6 +544,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -530,6 +555,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -540,6 +566,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -550,6 +577,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -560,6 +588,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -570,6 +599,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -586,6 +616,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_WITH_EXECUTOR_POLICY,
     })
   ),
@@ -596,6 +627,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -606,6 +638,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -616,6 +649,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -626,6 +660,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -636,6 +671,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -646,6 +682,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -663,6 +700,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -674,6 +712,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -684,6 +723,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -694,6 +734,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -704,6 +745,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -714,6 +756,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -746,6 +789,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       principalKinds: ['session', 'delegated'],
       delegatedServices: ['copilot'],
     })
@@ -756,6 +800,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       principalKinds: ['session', 'delegated'],
       delegatedServices: ['copilot'],
     })
@@ -800,6 +845,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -820,6 +866,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -830,6 +877,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_COPILOT_AND_EXECUTOR_PRINCIPAL_POLICY,
     })
   ),
@@ -840,6 +888,7 @@ export const knowledgeOperations = {
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'sourced',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -850,6 +899,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
+      contentDelivery: 'none',
       ...HUMAN_AND_COPILOT_PRINCIPAL_POLICY,
     })
   ),
@@ -866,6 +916,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -876,6 +927,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -886,6 +938,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
@@ -896,6 +949,7 @@ export const knowledgeOperations = {
       minimumRole: 'write',
       workspaceApiKey: 'allow',
       capability: 'knowledge.upload',
+      contentDelivery: 'none',
       ...ALL_PRINCIPAL_POLICY,
     })
   ),
diff --git a/apps/sim/lib/knowledge/application/read-original-document.test.ts b/apps/sim/lib/knowledge/application/read-original-document.test.ts
index 4ab20423c08..9df9cc92ba4 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.test.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.test.ts
@@ -21,8 +21,15 @@ vi.mock('@/lib/knowledge/secret-provenance', () => ({
   loadKnowledgeDocumentDurableSecretProvenance: mocks.provenance,
 }))
 
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { KNOWLEDGE_DELEGATION_AUDIENCE } from '@/lib/knowledge/application/authorization'
 import { readOriginalKnowledgeDocument } from '@/lib/knowledge/application/read-original-document'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 
 workspaceAuthzMockFns.mockPermissionSatisfies.mockImplementation(
   (actual: string | null) => actual !== null
@@ -54,6 +61,27 @@ const input = {
 }
 const run = () => readOriginalKnowledgeDocument.execute({ principal, input })
 
+/** A gate with no registry: it admits only items with no recorded secret. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+const runAsChat = () =>
+  observeContentDelivery(secretFreeGate, () =>
+    readOriginalKnowledgeDocument.execute({
+      principal: createCopilotChatPrincipal(
+        { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
+        KNOWLEDGE_DELEGATION_AUDIENCE
+      ),
+      input,
+    })
+  )
+
 describe('original knowledge document read', () => {
   beforeEach(() => {
     knowledgeContextsMockFns.mockResolveCanonicalActiveKnowledgeDocumentContext.mockResolvedValue(
@@ -61,6 +89,7 @@ describe('original knowledge document read', () => {
     )
     workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('read')
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: document.filename, fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [] },
     })
@@ -76,6 +105,7 @@ describe('original knowledge document read', () => {
       },
     })
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: document.filename, fileUrl: 'https://example.test/private' },
       provenance: { status: 'exact', entries: [] },
     })
@@ -113,21 +143,35 @@ describe('original knowledge document read', () => {
     ).rejects.toThrow(/limit/)
   })
   it.each([{ status: 'unknown' }, { status: 'exact', entries: [{ secret: 'private' }] }])(
-    'refuses originals without secret-free provenance',
+    'refuses Chat an original its gate refuses, before reading it: %j',
     async (provenance) => {
       mocks.provenance.mockResolvedValue({
+        storageKey: document.storageKey,
         source: { filename: document.filename, fileUrl: document.fileUrl },
         provenance,
       })
-      await expect(run()).rejects.toThrow('secret-free')
+      await expect(runAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
       expect(storageServiceMockFns.mockDownloadFile).not.toHaveBeenCalled()
     }
   )
-  it('refuses a concurrent source replacement before reading', async () => {
+  it('serves Chat a secret-free original under its gate', async () => {
+    expect(await runAsChat()).toMatchObject({ sourceAvailable: true, hasRecordedSecrets: false })
+  })
+  it('classifies a concurrent source replacement as unknown, refusing it before reading', async () => {
     mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
       source: { filename: 'changed', fileUrl: document.fileUrl },
       provenance: { status: 'exact', entries: [] },
     })
-    await expect(run()).rejects.toThrow('secret-free')
+    await expect(runAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(storageServiceMockFns.mockDownloadFile).not.toHaveBeenCalled()
+  })
+  it('reads for a caller outside Chat without classifying, flagging recorded secrets', async () => {
+    mocks.provenance.mockResolvedValue({
+      storageKey: document.storageKey,
+      source: { filename: document.filename, fileUrl: document.fileUrl },
+      provenance: { status: 'exact', entries: [{ secret: 'private' }] },
+    })
+    expect(await run()).toMatchObject({ sourceAvailable: true, hasRecordedSecrets: true })
   })
 })
diff --git a/apps/sim/lib/knowledge/application/read-original-document.ts b/apps/sim/lib/knowledge/application/read-original-document.ts
index 2af16362da2..40c99c5038b 100644
--- a/apps/sim/lib/knowledge/application/read-original-document.ts
+++ b/apps/sim/lib/knowledge/application/read-original-document.ts
@@ -1,4 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
+import { requireAdmittedContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { hashDurableSecretProvenanceValue } from '@/lib/execution/durable-secret-provenance'
 import { decodeDataUriWithinLimit } from '@/lib/file-parsers/data-uri'
@@ -31,7 +32,7 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
     principal: Principal
     input: ReadOriginalKnowledgeDocumentInput
   }) => resolveCanonicalActiveKnowledgeDocumentContext(input, principal),
-  async execute({ input, context }) {
+  async execute({ input, context, principal }) {
     const maxBytes = input.maxBytes ?? MAX_TEXT_EXTRACTION_BYTES
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_TEXT_EXTRACTION_BYTES)
       throw new OrchestrationError('validation', 'Invalid document read byte limit')
@@ -45,23 +46,31 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
       processingStatus: doc.processingStatus,
       indexReady: doc.enabled && doc.processingStatus === 'completed',
     }
-    const unavailable = { ...metadata, sourceAvailable: false as const, buffer: undefined }
     if (doc.fileSize > maxBytes)
       throw new OrchestrationError(
         'payload_too_large',
         'Document exceeds the source read byte limit'
       )
     const snapshot = await loadKnowledgeDocumentDurableSecretProvenance(doc.id)
-    if (
-      hashDurableSecretProvenanceValue(snapshot.source) !==
-        hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc)) ||
-      snapshot.provenance.status !== 'exact' ||
-      snapshot.provenance.entries.length !== 0
-    ) {
-      throw new OrchestrationError(
-        'forbidden',
-        'This document has no verified secret-free original. Read its projected indexed passages instead.'
-      )
+    const provenance =
+      snapshot.storageKey === doc.storageKey &&
+      hashDurableSecretProvenanceValue(snapshot.source) ===
+        hashDurableSecretProvenanceValue(createKnowledgeDocumentSourceValue(doc))
+        ? snapshot.provenance
+        : ({ status: 'unknown' } as const)
+    await requireAdmittedContent(principal, {
+      kind: 'knowledge-document',
+      id: doc.id,
+      provenance,
+      view: 'complete',
+    })
+    /** A visual of these bytes would show what text redaction hides. */
+    const hasRecordedSecrets = provenance.status === 'exact' && provenance.entries.length > 0
+    const unavailable = {
+      ...metadata,
+      sourceAvailable: false as const,
+      buffer: undefined,
+      hasRecordedSecrets,
     }
     if (!doc.storageKey && !doc.fileUrl.startsWith('data:')) return unavailable
     let buffer: Buffer
@@ -84,6 +93,6 @@ export const readOriginalKnowledgeDocument = defineAuthorizedKnowledgeUseCase({
       throw error
     }
     input.signal?.throwIfAborted()
-    return { ...metadata, sourceAvailable: true as const, buffer }
+    return { ...metadata, sourceAvailable: true as const, buffer, hasRecordedSecrets }
   },
 })
diff --git a/apps/sim/lib/knowledge/application/search.ts b/apps/sim/lib/knowledge/application/search.ts
index 515b3f73826..40b02571c8f 100644
--- a/apps/sim/lib/knowledge/application/search.ts
+++ b/apps/sim/lib/knowledge/application/search.ts
@@ -8,6 +8,7 @@ import {
 import { checkSearchUsageLimits } from '@/lib/billing/core/usage-gate-cache'
 import { recordUsage } from '@/lib/billing/core/usage-log'
 import { checkAndBillPayerOverageThreshold } from '@/lib/billing/threshold-billing'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeFromOwner, resourceScopeKey } from '@/lib/core/resource-scope'
 import { PlatformEvents } from '@/lib/core/telemetry'
@@ -17,6 +18,7 @@ import { reportDurableSecretProvenanceRefusal } from '@/lib/execution/durable-se
 import { requireOrganizationSearchAvailable } from '@/lib/knowledge/access/availability'
 import { createKnowledgeAccessProvider } from '@/lib/knowledge/access/scope'
 import type { KnowledgeAccessProvider } from '@/lib/knowledge/access/types'
+import { admitKnowledgeChunks } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   KnowledgeUsageLimitExceededError,
@@ -156,7 +158,7 @@ interface KnowledgeSearchCost {
   rerankerSearchUnits?: number
 }
 
-export interface SearchKnowledgeResult {
+interface SearchKnowledgeResult {
   retrieval: RetrievalStatus
   results: KnowledgeSearchItem[]
   query: string
@@ -480,7 +482,14 @@ export async function runKnowledgeSearch({
   })
   if (retrieved.retrieval.status === 'partial' && !input.allowPartialResults)
     throw new SearchDeadlineError()
-  let rows = retrieved.rows
+  input.signal?.throwIfAborted()
+  /**
+   * Chat sees each chunk only as its own gate admits it, before the reranker or the result: one
+   * chunk without provenance is left out instead of withholding the search. A result also renders
+   * its document's name and tags, so every secret the chunk and its document hold counts.
+   */
+  const admittedRows = await admitKnowledgeChunks(principal, retrieved.rows)
+  let rows = retrieved.rows.filter((row) => admittedRows.has(row.id))
   input.signal?.throwIfAborted()
   /** Public callers have no input envelope, but persisted reranker inputs still need provenance. */
   const registrySubjectUserId = resolvePrincipalSubjectUserId(principal)
@@ -806,7 +815,11 @@ const searchKnowledgeUseCase = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.search,
   resolveContext: ({ principal, input }: { principal: Principal; input: SearchKnowledgeInput }) =>
     measureSearchStage('knowledge_context', () => resolveKnowledgeSearchContext(input, principal)),
-  execute: ({ principal, input, context }) => runKnowledgeSearch({ principal, input, context }),
+  async execute({ principal, input, context }) {
+    /** Accounted up front: a search that retrieves nothing returns no chunk to admit. */
+    await admitContent(principal, [])
+    return runKnowledgeSearch({ principal, input, context })
+  },
   afterSuccess: ({ principal, context, input, result }) =>
     afterKnowledgeSearch({ principal, context, input, result }),
 })
diff --git a/apps/sim/lib/knowledge/application/tags.test.ts b/apps/sim/lib/knowledge/application/tags.test.ts
index 8cf227c05f7..59e17fe3316 100644
--- a/apps/sim/lib/knowledge/application/tags.test.ts
+++ b/apps/sim/lib/knowledge/application/tags.test.ts
@@ -1,4 +1,8 @@
-import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import type { Principal } from '@sim/auth/principal'
+import {
+  createDelegatedPrincipal,
+  createSessionPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import {
   knowledgeContextsMock,
@@ -19,11 +23,16 @@ vi.mock('@/lib/knowledge/application/contexts', () => knowledgeContextsMock)
 
 vi.mock('@/lib/knowledge/tags/service', () => knowledgeTagsServiceMock)
 
+const admission = vi.hoisted(() => ({ admitKnowledgeDocuments: vi.fn() }))
+vi.mock('@/lib/knowledge/application/admit-knowledge-content', () => admission)
+
+import { admitContent } from '@/lib/core/application'
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import {
   createKnowledgeTag,
   deleteKnowledgeTag,
   listKnowledgeTags,
+  readDetailedKnowledgeTagUsage,
   readKnowledgeTagUsage,
   readNextKnowledgeTagSlot,
   updateKnowledgeTag,
@@ -74,17 +83,13 @@ const documentContext = {
 
 const sessionPrincipal = createSessionPrincipal()
 
-const delegatedPrincipal = {
-  kind: 'delegated' as const,
-  serviceId: 'copilot',
+const delegatedPrincipal = createDelegatedPrincipal({
   subjectUserId: 'shared-user',
   workspaceId: 'workspace-a',
   delegationId: 'tool-call-1',
   audience: 'sim:knowledge',
-  issuedAt: new Date(),
-  expiresAt: new Date(Date.now() + 60_000),
   resourceScope: {},
-}
+})
 
 const mocks = {
   listTags: knowledgeTagsServiceMockFns.mockGetDocumentTagDefinitions,
@@ -117,63 +122,73 @@ describe('knowledge tag application use cases', () => {
   })
 
   it.each([
-    [
-      'list',
-      listKnowledgeTags,
-      { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
-    ],
-    [
-      'create',
-      createKnowledgeTag,
-      {
-        knowledgeBaseId: 'knowledge-b',
-        assertedWorkspaceId: 'workspace-a',
-        displayName: 'Region',
-      },
-    ],
-    [
-      'update',
-      updateKnowledgeTag,
-      {
-        tagDefinitionId: 'tag-b',
-        assertedWorkspaceId: 'workspace-a',
-        updates: { displayName: 'Market' },
-      },
-    ],
-    [
-      'delete',
-      deleteKnowledgeTag,
-      {
-        knowledgeBaseId: 'knowledge-b',
-        tagDefinitionId: 'tag-b',
-        assertedWorkspaceId: 'workspace-a',
-      },
-    ],
-    [
-      'read usage',
-      readKnowledgeTagUsage,
-      { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
-    ],
-  ])(
-    'rejects cross-workspace %s before current membership or tag work',
-    async (_name, useCase, input) => {
-      await expect(useCase.execute({ principal: delegatedPrincipal, input })).rejects.toMatchObject(
-        {
-          name: 'DelegatedWorkspaceAuthorizationError',
-          code: 'forbidden',
-        }
-      )
+    {
+      name: 'list',
+      run: () =>
+        listKnowledgeTags.execute({
+          principal: delegatedPrincipal,
+          input: { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
+        }),
+    },
+    {
+      name: 'create',
+      run: () =>
+        createKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            knowledgeBaseId: 'knowledge-b',
+            assertedWorkspaceId: 'workspace-a',
+            displayName: 'Region',
+          },
+        }),
+    },
+    {
+      name: 'update',
+      run: () =>
+        updateKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            tagDefinitionId: 'tag-b',
+            assertedWorkspaceId: 'workspace-a',
+            updates: { displayName: 'Market' },
+          },
+        }),
+    },
+    {
+      name: 'delete',
+      run: () =>
+        deleteKnowledgeTag.execute({
+          principal: delegatedPrincipal,
+          input: {
+            knowledgeBaseId: 'knowledge-b',
+            tagDefinitionId: 'tag-b',
+            assertedWorkspaceId: 'workspace-a',
+          },
+        }),
+    },
+    {
+      name: 'read usage',
+      run: () =>
+        readKnowledgeTagUsage.execute({
+          principal: delegatedPrincipal,
+          input: { knowledgeBaseId: 'knowledge-b', assertedWorkspaceId: 'workspace-a' },
+        }),
+    },
+  ])('rejects cross-workspace $name before current membership or tag work', async ({ run }) => {
+    await expect(run()).rejects.toMatchObject({
+      name: 'DelegatedWorkspaceAuthorizationError',
+      code: 'forbidden',
+    })
 
-      expect(mocks.resolvePermission).not.toHaveBeenCalled()
-      expect(mocks.listTags).not.toHaveBeenCalled()
-      expect(mocks.nextSlot).not.toHaveBeenCalled()
-      expect(mocks.createTag).not.toHaveBeenCalled()
-      expect(mocks.updateTag).not.toHaveBeenCalled()
-      expect(mocks.deleteTag).not.toHaveBeenCalled()
-      expect(mocks.readUsage).not.toHaveBeenCalled()
-      expect(mocks.recordAudit).not.toHaveBeenCalled()
-    }
-  )
+    expect(mocks.resolvePermission).not.toHaveBeenCalled()
+    expect(mocks.listTags).not.toHaveBeenCalled()
+    expect(mocks.nextSlot).not.toHaveBeenCalled()
+    expect(mocks.createTag).not.toHaveBeenCalled()
+    expect(mocks.updateTag).not.toHaveBeenCalled()
+    expect(mocks.deleteTag).not.toHaveBeenCalled()
+    expect(mocks.readUsage).not.toHaveBeenCalled()
+    expect(mocks.recordAudit).not.toHaveBeenCalled()
+  })
 
   it.each([
     ['an unknown slot', { tagSlot: 'tag99', fieldType: 'text' }],
@@ -353,4 +368,100 @@ describe('knowledge tag application use cases', () => {
       })
     }
   )
+
+  describe('tag usage Chat may see', () => {
+    const chat = { ...delegatedPrincipal, workspaceId: 'workspace-b' }
+    /** One document under two definitions: its value is refused under one and admitted under the other. */
+    const detailed = [
+      {
+        tagName: 'Region',
+        tagSlot: 'tag1',
+        documentCount: 2,
+        documents: [
+          { id: 'doc-shared', name: 'shared.csv', tagValue: 'refused' },
+          { id: 'doc-other', name: 'other.csv', tagValue: 'emea' },
+        ],
+      },
+      {
+        tagName: 'Owner',
+        tagSlot: 'tag2',
+        documentCount: 1,
+        documents: [{ id: 'doc-shared', name: 'shared.csv', tagValue: 'ops' }],
+      },
+    ]
+
+    beforeEach(() => {
+      mocks.resolvePermission.mockResolvedValue('read')
+      mocks.readDetailedUsage.mockResolvedValue(detailed)
+      /** Stands in for the gate: refuses an occurrence by the value it shows. */
+      admission.admitKnowledgeDocuments.mockImplementation(
+        async (principal: Principal, documents: { id: string; value: { tagValue: string } }[]) => {
+          await admitContent(principal, [])
+          return new Set(
+            documents.filter((doc) => doc.value.tagValue !== 'refused').map((doc) => doc.id)
+          )
+        }
+      )
+    })
+
+    it('answers Chat an empty usage for a base with no tag definitions', async () => {
+      mocks.readDetailedUsage.mockResolvedValue([])
+      await expect(
+        readDetailedKnowledgeTagUsage.execute({
+          principal: chat,
+          input: { knowledgeBaseId: 'knowledge-b' },
+        })
+      ).resolves.toMatchObject({ usage: [] })
+      expect(admission.admitKnowledgeDocuments).not.toHaveBeenCalled()
+    })
+
+    it('binds each occurrence to the stored tag value it shows', async () => {
+      await readDetailedKnowledgeTagUsage.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+      const [, documents] = admission.admitKnowledgeDocuments.mock.calls[1]
+      expect(documents).toEqual([
+        expect.objectContaining({
+          id: 'doc-shared',
+          snapshot: { filename: 'shared.csv', tag2: 'ops' },
+        }),
+      ])
+    })
+
+    it('decides each (definition, document) occurrence on its own', async () => {
+      const result = await readDetailedKnowledgeTagUsage.execute({
+        principal: chat,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+
+      expect(result.usage[0]).toMatchObject({
+        documentCount: 1,
+        documents: [{ id: 'doc-other' }],
+      })
+      expect(result.usage[1]).toBe(detailed[1])
+    })
+
+    it('leaves a person’s counts as stored, without reading documents', async () => {
+      const stats = [
+        {
+          id: 'def-1',
+          tagSlot: 'tag1',
+          displayName: 'Region',
+          fieldType: 'text',
+          documentCount: 2,
+          chunkCount: 9,
+        },
+      ]
+      mocks.readUsage.mockResolvedValue(stats)
+
+      const result = await readKnowledgeTagUsage.execute({
+        principal: sessionPrincipal,
+        input: { knowledgeBaseId: 'knowledge-b' },
+      })
+
+      expect(result.usage).toBe(stats)
+      expect(mocks.readDetailedUsage).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/apps/sim/lib/knowledge/application/tags.ts b/apps/sim/lib/knowledge/application/tags.ts
index 9bf78e6f0e9..6371a8ced93 100644
--- a/apps/sim/lib/knowledge/application/tags.ts
+++ b/apps/sim/lib/knowledge/application/tags.ts
@@ -1,8 +1,10 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateRequestId } from '@/lib/core/utils/request'
+import { admitKnowledgeDocuments } from '@/lib/knowledge/application/admit-knowledge-content'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import {
   resolveActiveKnowledgeResourceContext,
@@ -349,6 +351,37 @@ export const deleteKnowledgeTag = defineAuthorizedKnowledgeUseCase({
   }),
 })
 
+/**
+ * The documents each tag definition lists, admitted per (definition, document) occurrence: a
+ * document shows a different tag value under each definition, so one occurrence's verdict says
+ * nothing about another's.
+ */
+async function admitTagUsage(
+  principal: Principal,
+  usage: Awaited<ReturnType<typeof getTagUsage>>
+): Promise<Awaited<ReturnType<typeof getTagUsage>>> {
+  /** A base with no tag definitions returns nothing, which is still an accounting. */
+  if (usage.length === 0) await admitContent(principal, [])
+  const admitted = []
+  for (const definition of usage) {
+    const ids = await admitKnowledgeDocuments(
+      principal,
+      definition.documents.map((doc) => ({
+        id: doc.id,
+        value: doc,
+        snapshot: { filename: doc.name, [definition.tagSlot]: doc.tagValue },
+      }))
+    )
+    const documents = definition.documents.filter((doc) => ids.has(doc.id))
+    admitted.push(
+      documents.length === definition.documents.length
+        ? definition
+        : { ...definition, documents, documentCount: documents.length }
+    )
+  }
+  return admitted
+}
+
 export const readKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
@@ -364,10 +397,9 @@ export const readDetailedKnowledgeTagUsage = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readDetailedTagUsage,
   resolveContext: ({ principal, input }: { principal: Principal; input: ListKnowledgeTagsInput }) =>
     resolveActiveKnowledgeResourceContext(input, principal),
-  async execute({ context }) {
-    return {
-      usage: await getTagUsage(context.knowledgeBaseId, generateRequestId(), context.access),
-    }
+  async execute({ principal, context }) {
+    const usage = await getTagUsage(context.knowledgeBaseId, generateRequestId(), context.access)
+    return { usage: await admitTagUsage(principal, usage) }
   },
 })
 
diff --git a/apps/sim/lib/knowledge/documents/document-processor.ts b/apps/sim/lib/knowledge/documents/document-processor.ts
index eacda690ff2..94546645e74 100644
--- a/apps/sim/lib/knowledge/documents/document-processor.ts
+++ b/apps/sim/lib/knowledge/documents/document-processor.ts
@@ -79,6 +79,7 @@ import type { VisionExtractionUsage } from '@/lib/knowledge/documents/vision-che
 import {
   assertKnowledgeOpaqueModelInputSafe,
   getKnowledgeOpaqueModelInputRegistry,
+  projectKnowledgeModelInput,
 } from '@/lib/knowledge/model-input-provenance'
 import { getFileExtension, isInternalFileUrl } from '@/lib/uploads/utils/file-utils'
 import {
@@ -305,7 +306,7 @@ export async function processDocument(
       ? { content: image.renderedText, processingMethod: 'vision-extract' }
       : await parseDocument(fileUrl, filename, mimeType, access, workspaceId)
     access.signal?.throwIfAborted()
-    const { content, processingMethod, cloudUrl } = parseResult
+    const { content: parsedContent, processingMethod, cloudUrl } = parseResult
     if (parseResult.metadata?.detectedType || parseResult.metadata?.warning) {
       logger.info('Parser reported a warning for the document', {
         filename,
@@ -320,13 +321,15 @@ export async function processDocument(
      * document that reports success while holding nothing. Failing here keeps it
      * visible with a reason instead.
      */
-    if (parseResult.metadata?.degraded || !content.trim()) {
+    if (parseResult.metadata?.degraded || !parsedContent.trim()) {
       throw new PermanentDocumentProcessingError(
         'no_extractable_text',
         unreadableDocumentMessage(filename)
       )
     }
 
+    // Chunkers transform text; source and parser budgets already bound this materialized input.
+    const content = projectKnowledgeModelInput(parsedContent, Number.POSITIVE_INFINITY)
     let chunks: Chunk[]
     const metadata: FileParseMetadata = parseResult.metadata ?? {}
 
@@ -398,7 +401,7 @@ export async function processDocument(
     }
 
     access.signal?.throwIfAborted()
-    const characterCount = content.length
+    const characterCount = parsedContent.length
     const tokenCount = chunks.reduce((sum, chunk) => sum + chunk.tokenCount, 0)
 
     logger.info(`Document processed: ${chunks.length} chunks, ${tokenCount} tokens`)
diff --git a/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts b/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
index 9eddddb08ab..43498f3d722 100644
--- a/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
+++ b/apps/sim/lib/knowledge/documents/ocr-checkpoints.test.ts
@@ -12,7 +12,8 @@ const hoisted = vi.hoisted(() => ({
   executeOcr: vi.fn(),
 }))
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
-vi.mock('@/lib/knowledge/model-input-provenance', () => ({
+vi.mock(import('@/lib/knowledge/model-input-provenance'), async (importOriginal) => ({
+  ...(await importOriginal()),
   getKnowledgeOpaqueModelInputRegistry: hoisted.provenance,
   assertKnowledgeOpaqueModelInputSafe: hoisted.provenance,
 }))
diff --git a/apps/sim/lib/knowledge/model-input-provenance.ts b/apps/sim/lib/knowledge/model-input-provenance.ts
index bf15f898be2..fa0a169dd16 100644
--- a/apps/sim/lib/knowledge/model-input-provenance.ts
+++ b/apps/sim/lib/knowledge/model-input-provenance.ts
@@ -116,12 +116,12 @@ export function getKnowledgeOpaqueModelInputRegistry(): ResolvedSecretTraceRegis
   return context.registry ?? new ResolvedSecretTraceRegistry()
 }
 
-/** Projects one string immediately before it enters an embedding or reranking request. */
-export function projectKnowledgeModelInput(value: string): string {
+/** Projects known literals in text before its transformation or delivery to a model. */
+export function projectKnowledgeModelInput(value: string, maxBytes?: number): string {
   const registry = knowledgeModelInputContext.getStore()?.registry
   if (!registry) return value
 
-  const projection = projectResolvedSecretModelContent(value, registry)
+  const projection = projectResolvedSecretModelContent(value, registry, maxBytes)
   if (!projection.safe || typeof projection.value !== 'string') {
     refuseResolvedSecretProjection({
       site: 'knowledge.modelInput',
diff --git a/apps/sim/lib/knowledge/secret-provenance.test.ts b/apps/sim/lib/knowledge/secret-provenance.test.ts
index b16e7edecd2..0c8c3a37b62 100644
--- a/apps/sim/lib/knowledge/secret-provenance.test.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.test.ts
@@ -5,9 +5,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DbTransaction } from '@/lib/db/types'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
+  classifyKnowledgeDocumentMetadata,
   createKnowledgeDocumentSourceValue,
   importKnowledgePersistedResponseSecretProvenance,
   importKnowledgeSearchResultSecretProvenance,
+  knowledgeDocumentSnapshot,
   loadKnowledgeDocumentSecretRegistry,
   replaceKnowledgeDocumentSecretProvenanceInTx,
 } from '@/lib/knowledge/secret-provenance'
@@ -167,3 +169,50 @@ describe('knowledge durable provenance enforcement', () => {
     expect(registry.isPermanentlyIncomplete()).toBe(true)
   })
 })
+
+describe('document metadata classification bound to the shown snapshot', () => {
+  const NUMBERED_ROW = { ...DOCUMENT_ROW, tag1: 'emea', number1: 42 }
+
+  beforeEach(() => {
+    resetDbChainMock()
+  })
+
+  it('keeps the stored classification while the shown metadata is what is stored', async () => {
+    queueTableRows(document, [NUMBERED_ROW])
+    const result = await classifyKnowledgeDocumentMetadata(
+      [NUMBERED_ROW.id],
+      new Map([[NUMBERED_ROW.id, [{ filename: 'source.pdf', tag1: 'emea', number1: '42' }]]])
+    )
+    expect(result.get(NUMBERED_ROW.id)?.status).toBe('exact')
+  })
+
+  it.each([
+    ['a renamed document', { filename: 'previous-name.pdf' }],
+    ['an edited tag', { tag1: 'previous value' }],
+    ['a tag cleared since', { tag2: 'previous value' }],
+    ['an edited number', { number1: '7' }],
+  ])(
+    'reads %s as unknown, so stale values are not paired with new provenance',
+    async (_, shown) => {
+      queueTableRows(document, [NUMBERED_ROW])
+      const result = await classifyKnowledgeDocumentMetadata(
+        [NUMBERED_ROW.id],
+        new Map([[NUMBERED_ROW.id, [shown]]])
+      )
+      expect(result.get(NUMBERED_ROW.id)).toEqual({ status: 'unknown' })
+    }
+  )
+
+  it('picks only the editable metadata a returned value shows', () => {
+    expect(
+      knowledgeDocumentSnapshot({
+        id: 'd',
+        filename: 'f.pdf',
+        tag3: 'x',
+        fileUrl: '/u',
+        date1: 'd',
+      })
+    ).toEqual({ filename: 'f.pdf', tag3: 'x' })
+    expect(knowledgeDocumentSnapshot({ id: 'd', fileUrl: '/u' })).toBeUndefined()
+  })
+})
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index 3f73183cb46..60cf942f339 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -6,7 +6,7 @@ import {
   embeddingSecretProvenance,
 } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
-import { and, eq, inArray, isNull, type SQL } from 'drizzle-orm'
+import { and, eq, inArray, isNull, type SQL, sql } from 'drizzle-orm'
 import type { DbTransaction } from '@/lib/db/types'
 import {
   bindDurableSecretProvenanceToValue,
@@ -184,6 +184,8 @@ interface KnowledgeEmbeddingSecretProvenanceRow {
 
 const KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION = {
   id: document.id,
+  knowledgeBaseId: document.knowledgeBaseId,
+  storageKey: document.storageKey,
   secretProvenanceVersion: document.secretProvenanceVersion,
   filename: document.filename,
   fileUrl: document.fileUrl,
@@ -222,9 +224,18 @@ const KNOWLEDGE_EMBEDDING_PROVENANCE_SELECTION = {
   entries: embeddingSecretProvenance.entries,
 }
 
-function selectKnowledgeDocumentProvenanceRows(where: SQL<unknown> | undefined) {
+function selectKnowledgeDocumentProvenanceRows(
+  where: SQL<unknown> | undefined,
+  deferInlineContent = false
+) {
   return db
-    .select(KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION)
+    .select({
+      ...KNOWLEDGE_DOCUMENT_PROVENANCE_SELECTION,
+      fileUrl: deferInlineContent
+        ? sql<string>`CASE WHEN ${document.fileUrl} LIKE 'data:%' THEN '' ELSE ${document.fileUrl} END`
+        : document.fileUrl,
+      hasInlineFile: sql<boolean>`${document.fileUrl} LIKE 'data:%'`,
+    })
     .from(document)
     .leftJoin(documentSecretProvenance, eq(documentSecretProvenance.documentId, document.id))
     .where(where)
@@ -439,8 +450,180 @@ export async function loadKnowledgeDocumentSecretRegistry(
   return { registry, provenance, tracked: true }
 }
 
+/**
+ * Metadata fields a person can edit in place that can hold text, which a returned snapshot is
+ * checked against. Date and boolean slots are typed columns no secret text can occupy.
+ */
+const EDITABLE_DOCUMENT_FIELDS = [
+  'filename',
+  'sourceUrl',
+  'tag1',
+  'tag2',
+  'tag3',
+  'tag4',
+  'tag5',
+  'tag6',
+  'tag7',
+  'number1',
+  'number2',
+  'number3',
+  'number4',
+  'number5',
+] as const satisfies readonly (keyof KnowledgeDocumentSourceValue)[]
+
+/** What a result shows of a document's metadata by stored field name, to bind its class to. */
+export type KnowledgeDocumentSnapshot = Readonly<Record<string, unknown>>
+
+const isEditableField = (field: string): boolean =>
+  (EDITABLE_DOCUMENT_FIELDS as readonly string[]).includes(field)
+
+function comparableField(value: unknown): string | null {
+  if (value === null || value === undefined || value === '') return null
+  return String(value)
+}
+
+/** A number slot is compared by value, since its text form can differ from its stored form. */
+function sameField(stored: unknown, shown: unknown): boolean {
+  const left = comparableField(stored)
+  const right = comparableField(shown)
+  if (left === right) return true
+  if (left === null || right === null) return false
+  return typeof stored === 'number' && Number(right) === stored
+}
+
+function matchesDocumentSnapshot(
+  source: KnowledgeDocumentSourceValue,
+  snapshot: KnowledgeDocumentSnapshot
+): boolean {
+  return Object.entries(snapshot).every(
+    ([field, shown]) => !isEditableField(field) || sameField(Reflect.get(source, field), shown)
+  )
+}
+
+/** Picks the editable metadata a returned value shows, when it shows any. */
+export function knowledgeDocumentSnapshot(value: unknown): KnowledgeDocumentSnapshot | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined
+  const snapshot: Record<string, unknown> = {}
+  let shown = false
+  for (const field of EDITABLE_DOCUMENT_FIELDS) {
+    if (Object.hasOwn(value, field)) {
+      snapshot[field] = Reflect.get(value, field)
+      shown = true
+    }
+  }
+  return shown ? snapshot : undefined
+}
+
+/**
+ * Classifies the rendered metadata of each document. A document whose stored metadata no longer
+ * matches a snapshot the result shows reads as unknown: a concurrent edit must not pair the old
+ * values, which the result still carries, with the new row's classification. Inline originals
+ * needed for tracked bindings are loaded one at a time, never materialized as a metadata page.
+ */
+export async function classifyKnowledgeDocumentMetadata(
+  documentIds: readonly string[],
+  snapshots?: ReadonlyMap<string, readonly KnowledgeDocumentSnapshot[]>
+): Promise<Map<string, DurableSecretProvenance>> {
+  const ids = [...new Set(documentIds)]
+  const rows = ids.length
+    ? await selectKnowledgeDocumentProvenanceRows(inArray(document.id, ids), true)
+    : []
+  const result = new Map<string, DurableSecretProvenance>()
+  for (const metadata of rows) {
+    const row =
+      metadata.hasInlineFile && metadata.secretProvenanceVersion !== null
+        ? (await selectKnowledgeDocumentProvenanceRows(eq(document.id, metadata.id)).limit(1))[0]
+        : metadata
+    if (!row) {
+      result.set(metadata.id, { status: 'unknown' })
+      continue
+    }
+    const source = createKnowledgeDocumentSourceValue(row)
+    const stale = (snapshots?.get(row.id) ?? []).some(
+      (snapshot) => !matchesDocumentSnapshot(source, snapshot)
+    )
+    result.set(
+      row.id,
+      stale
+        ? { status: 'unknown' }
+        : filterKnowledgeDocumentMetadataSecretProvenance(
+            readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
+            source
+          )
+    )
+  }
+  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
+  return result
+}
+
+interface KnowledgeChunkContentSnapshot {
+  id: string
+  documentId: string
+  content: string
+}
+
+/** Classifies chunk bytes against their current stored identity and content binding. */
+export async function classifyKnowledgeChunkContent(
+  chunks: readonly KnowledgeChunkContentSnapshot[]
+): Promise<Map<string, DurableSecretProvenance>> {
+  const ids = [...new Set(chunks.map((chunk) => chunk.id))]
+  const rows = ids.length
+    ? await selectKnowledgeEmbeddingProvenanceRows(inArray(embedding.id, ids))
+    : []
+  const rowById = new Map(rows.map((row) => [row.id, row]))
+  return new Map(
+    chunks.map((chunk): [string, DurableSecretProvenance] => {
+      const row = rowById.get(chunk.id)
+      return [
+        chunk.id,
+        !row || row.documentId !== chunk.documentId || row.content !== chunk.content
+          ? { status: 'unknown' }
+          : readBoundKnowledgeEmbeddingSecretProvenance(row),
+      ]
+    })
+  )
+}
+
+/**
+ * Classifies a result's chunk bytes and the document metadata it displays. Both are bound to
+ * the returned snapshots; tracked inline originals are loaded individually for metadata bindings.
+ */
+export async function classifyKnowledgeChunks(
+  chunks: readonly (KnowledgeChunkContentSnapshot & { snapshot?: KnowledgeDocumentSnapshot })[]
+): Promise<Map<string, DurableSecretProvenance>> {
+  const snapshots = new Map<string, KnowledgeDocumentSnapshot[]>()
+  for (const chunk of chunks) {
+    if (chunk.snapshot) {
+      const current = snapshots.get(chunk.documentId)
+      if (current) current.push(chunk.snapshot)
+      else snapshots.set(chunk.documentId, [chunk.snapshot])
+    }
+  }
+  const [contents, documents] = await Promise.all([
+    classifyKnowledgeChunkContent(chunks),
+    classifyKnowledgeDocumentMetadata(
+      chunks.map((chunk) => chunk.documentId),
+      snapshots
+    ),
+  ])
+  return new Map(
+    chunks.map((chunk): [string, DurableSecretProvenance] => [
+      chunk.id,
+      mergeDurableSecretProvenance(
+        contents.get(chunk.id) ?? { status: 'unknown' },
+        documents.get(chunk.documentId) ?? { status: 'unknown' }
+      ),
+    ])
+  )
+}
+
 /** Loads the bound document classification for copy/re-entry callers that do not need a registry. */
-export async function loadKnowledgeDocumentDurableSecretProvenance(documentId: string): Promise<{
+export async function loadKnowledgeDocumentDurableSecretProvenance(
+  documentId: string,
+  snapshot?: KnowledgeDocumentSnapshot
+): Promise<{
+  knowledgeBaseId: string
+  storageKey: string | null
   source: KnowledgeDocumentSourceValue
   provenance: DurableSecretProvenance
   tracked: boolean
@@ -449,8 +632,13 @@ export async function loadKnowledgeDocumentDurableSecretProvenance(documentId: s
   if (!row) throw new Error('Document not found')
   const source = createKnowledgeDocumentSourceValue(row)
   return {
+    knowledgeBaseId: row.knowledgeBaseId,
+    storageKey: row.storageKey,
     source,
-    provenance: readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
+    provenance:
+      snapshot && !matchesDocumentSnapshot(source, snapshot)
+        ? { status: 'unknown' }
+        : readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
     tracked: row.secretProvenanceVersion === 1,
   }
 }
diff --git a/apps/sim/lib/knowledge/transfer/export-archive.test.ts b/apps/sim/lib/knowledge/transfer/export-archive.test.ts
index d087ec59bea..7bee0ddafdc 100644
--- a/apps/sim/lib/knowledge/transfer/export-archive.test.ts
+++ b/apps/sim/lib/knowledge/transfer/export-archive.test.ts
@@ -23,6 +23,7 @@ import { MAX_DOCUMENT_CHUNKS } from '@/lib/knowledge/documents/document-processi
 import {
   buildKnowledgeBundleArchive,
   knowledgeBundleFileName,
+  openKnowledgeExportFile,
 } from '@/lib/knowledge/transfer/export-archive'
 import type { ExportableChunk, ExportableDocument } from '@/lib/knowledge/transfer/export-source'
 
@@ -82,6 +83,10 @@ function bundle(overrides: Partial<KnowledgeBaseExportBundle> = {}): KnowledgeBa
       }),
       exportableDocument({ id: TEXT_ONLY_ID, filename: 'wiki page', file: null }),
     ],
+    file: (document) => {
+      if (!document.file) throw new Error('Fixture has no original')
+      return openKnowledgeExportFile(document.file)
+    },
     chunks: (documentId) =>
       documentId === STORED_ID
         ? chunksOf(chunk(0, [0.25, 0.5]), chunk(1, [1, 2]))
diff --git a/apps/sim/lib/knowledge/transfer/export-archive.ts b/apps/sim/lib/knowledge/transfer/export-archive.ts
index 1185abb6d55..1a8a2f97f34 100644
--- a/apps/sim/lib/knowledge/transfer/export-archive.ts
+++ b/apps/sim/lib/knowledge/transfer/export-archive.ts
@@ -37,12 +37,16 @@ export function knowledgeBundleFileName(knowledgeBaseName: string): string {
   return `${safeBundleLeafName(knowledgeBaseName)}.simkb.zip`
 }
 
-async function openFileSource(source: ExportableFileSource): Promise<Readable | Buffer> {
+/** Opens one captured original; inline bytes can be supplied from their classified row snapshot. */
+export async function openKnowledgeExportFile(
+  source: ExportableFileSource,
+  inlineFileUrl?: string
+): Promise<Readable | Buffer> {
   if (source.kind === 'storage') {
     return downloadFileStream({ key: source.key, context: 'knowledge-base' })
   }
   return decodeDataUriWithinLimit(
-    await readInlineFileUrl(source.knowledgeBaseId, source.documentId),
+    inlineFileUrl ?? (await readInlineFileUrl(source.knowledgeBaseId, source.documentId)),
     MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE
   ).buffer
 }
@@ -149,7 +153,7 @@ async function appendBundleEntries(
   for (const document of bundle.documents) {
     const entries = bundleEntryPaths(document)
     if (document.file && entries.file) {
-      await appendEntry(archive, await openFileSource(document.file), entries.file, closed)
+      await appendEntry(archive, await bundle.file(document), entries.file, closed)
     }
     const chunkCount = entries.chunks
       ? await appendChunkEntry(
diff --git a/apps/sim/lib/knowledge/transfer/export-source.ts b/apps/sim/lib/knowledge/transfer/export-source.ts
index c2e5ca0844a..def2ee496a8 100644
--- a/apps/sim/lib/knowledge/transfer/export-source.ts
+++ b/apps/sim/lib/knowledge/transfer/export-source.ts
@@ -185,13 +185,15 @@ export async function listExportableDocuments(
 export async function* iterateDocumentChunks(
   knowledgeBaseId: string,
   documentId: string,
-  dimensions: KbEmbeddingDimensions | null
+  dimensions: KbEmbeddingDimensions | null,
+  admitPage?: (chunks: readonly (ExportableChunk & { id: string })[]) => Promise<void>
 ): AsyncGenerator<ExportableChunk> {
   const pageSize = dimensions ? CHUNK_PAGE_SIZE.vectors : CHUNK_PAGE_SIZE.text
   let after: number | null = null
   for (;;) {
     const page = await db
       .select({
+        id: embedding.id,
         index: embedding.chunkIndex,
         content: embedding.content,
         tokenCount: embedding.tokenCount,
@@ -211,7 +213,8 @@ export async function* iterateDocumentChunks(
       .orderBy(asc(embedding.chunkIndex))
       .limit(pageSize)
 
-    yield* page
+    await admitPage?.(page)
+    for (const { id: _id, ...chunk } of page) yield chunk
     if (page.length < pageSize) break
     after = page[page.length - 1].index
   }
diff --git a/apps/sim/lib/logs/application/operations.ts b/apps/sim/lib/logs/application/operations.ts
index 1f83b5f956f..1e67b4c8f06 100644
--- a/apps/sim/lib/logs/application/operations.ts
+++ b/apps/sim/lib/logs/application/operations.ts
@@ -24,6 +24,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...LOG_READER_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: aggregate run counts carry no execution payload, so there is nothing here for a group to withhold
@@ -33,6 +34,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -43,6 +45,7 @@ export const logOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...LOG_READER_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the executor reading its own run's snapshot mid-flight; refusing it would fail runs the group permits
diff --git a/apps/sim/lib/mcp/application/operations.ts b/apps/sim/lib/mcp/application/operations.ts
index 1f38e05b576..1253fb734de 100644
--- a/apps/sim/lib/mcp/application/operations.ts
+++ b/apps/sim/lib/mcp/application/operations.ts
@@ -44,6 +44,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listManagedConnections: defineWorkspaceOperation({
@@ -59,6 +60,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...DISCOVERY_PRINCIPAL_POLICY,
   }),
   executeTool: defineWorkspaceOperation({
@@ -66,6 +68,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...EXECUTION_PRINCIPAL_POLICY,
   }),
   /**
@@ -90,6 +93,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -106,6 +110,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   listWorkflowDeploymentTools: defineWorkspaceOperation({
@@ -114,6 +119,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   createWorkflowDeploymentServer: defineWorkspaceOperation({
@@ -122,6 +128,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -143,6 +150,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   deleteWorkflowDeploymentServer: defineWorkspaceOperation({
@@ -151,6 +159,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   deployWorkflowTool: defineWorkspaceOperation({
@@ -159,6 +168,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   undeployWorkflowTool: defineWorkspaceOperation({
@@ -167,6 +177,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.mcp',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -175,6 +186,7 @@ export const mcpServerOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -183,6 +195,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   register: defineWorkspaceOperation({
@@ -191,6 +204,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -199,6 +213,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   reconfigure: defineWorkspaceOperation({
@@ -207,6 +222,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   /** Pointing a server at another host or path; deployed workflows pin servers by id. */
@@ -216,6 +232,7 @@ export const mcpServerOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -224,6 +241,7 @@ export const mcpServerOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'mcp_tools.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/media/ffmpeg-content.integration.ts b/apps/sim/lib/media/ffmpeg-content.integration.ts
new file mode 100644
index 00000000000..9c4557e634d
--- /dev/null
+++ b/apps/sim/lib/media/ffmpeg-content.integration.ts
@@ -0,0 +1,308 @@
+/** Real file versions, storage, and output lineage around the media-processing boundary. */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import * as audit from '@sim/audit'
+import { db } from '@sim/db'
+import { auditLog, organization, user, workspace } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { observeContentDelivery, observeContentOutsideModel } from '@/lib/core/application'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import type { FfmpegOperation, MediaFile } from '@/lib/media/ffmpeg'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { ffmpegServerTool } from '@/lib/mothership/tools/server/media/ffmpeg'
+import * as workspaceReader from '@/lib/uploads/contexts/workspace'
+import {
+  fetchWorkspaceFileBuffer,
+  getWorkspaceFile,
+  updateWorkspaceFileContent,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import {
+  getBoundWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/lib/media/ffmpeg', () => ({
+  runFfmpegOperation: async (_operation: FfmpegOperation, inputs: MediaFile[]) => ({
+    buffer: inputs[0].buffer,
+    ext: 'bin',
+    contentType: 'application/octet-stream',
+  }),
+}))
+
+const ids = createKnowledgeAclFixtureIds()
+const SECRET = 'fixture-media-token-847159'
+const CLEAN = { status: 'exact', entries: [] } as const
+let known: WorkspaceFileSecretProvenance
+let submittedAudits = 0
+
+async function drainAudits() {
+  await vi.waitFor(async () =>
+    expect(
+      await db
+        .select({ id: auditLog.id })
+        .from(auditLog)
+        .where(eq(auditLog.workspaceId, ids.workspaceId))
+    ).toHaveLength(submittedAudits)
+  )
+}
+
+async function replace(fileId: string, content: string, provenance: WorkspaceFileSecretProvenance) {
+  return updateWorkspaceFileContent(
+    ids.workspaceId,
+    fileId,
+    ids.aliceId,
+    Buffer.from(content),
+    undefined,
+    {
+      version: { source: 'api', authorUserId: ids.aliceId },
+      secretProvenancePolicy: { mode: 'replace', provenance },
+    }
+  )
+}
+
+beforeAll(async () => {
+  storage.root = mkdtempSync(path.join(tmpdir(), 'sim-media-lineage-'))
+  await seedKnowledgeAclFixture(ids)
+  known = {
+    status: 'exact',
+    entries: [
+      {
+        name: 'MEDIA_TOKEN',
+        encryptedValue: (await encryptSecret(SECRET)).encrypted,
+        sourceUserId: ids.aliceId,
+        sourceWorkspaceId: ids.workspaceId,
+      },
+    ],
+  }
+  const record = audit.recordAudit
+  vi.spyOn(audit, 'recordAudit').mockImplementation((entry) => {
+    if (entry.workspaceId === ids.workspaceId) submittedAudits += 1
+    record(entry)
+  })
+  const batch = audit.recordAuditBatch
+  vi.spyOn(audit, 'recordAuditBatch').mockImplementation((entries) => {
+    submittedAudits += entries.filter((entry) => entry.workspaceId === ids.workspaceId).length
+    batch(entries)
+  })
+})
+
+afterAll(async () => {
+  await drainAudits()
+  vi.restoreAllMocks()
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  await rm(storage.root, { recursive: true, force: true })
+})
+
+describe('media input version lineage', () => {
+  it.each(['known', 'unknown'] as const)(
+    'preserves the storage size-limit error for an admitted %s media source',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(SECRET),
+        `bounded-${generateId()}.bin`,
+        'application/octet-stream',
+        {
+          secretProvenance: classification === 'known' ? known : { status: 'unknown' },
+          notifyWorkspaceChange: false,
+        }
+      )
+      await expect(
+        observeContentOutsideModel(() =>
+          readWorkspaceFileContent.execute({
+            principal: createCopilotChatPrincipal(
+              { userId: ids.aliceId, workspaceId: ids.workspaceId },
+              WORKSPACE_FILES_DELEGATION_AUDIENCE
+            ),
+            input: { fileId: file.id, maxBytes: 8, includeSecretProvenance: true },
+          })
+        )
+      ).rejects.toMatchObject({
+        name: 'PayloadSizeLimitError',
+        maxBytes: 8,
+        observedBytes: Buffer.byteLength(SECRET),
+      })
+    }
+  )
+
+  it.each(['known', 'unknown'] as const)(
+    'does not expose storage failures for %s input bytes before a read result exists',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from(SECRET),
+        `${SECRET}-${classification}.bin`,
+        'application/octet-stream',
+        {
+          secretProvenance: classification === 'known' ? known : { status: 'unknown' },
+          notifyWorkspaceChange: false,
+        }
+      )
+      await rm(path.join(storage.root, file.key))
+      await expect(fetchWorkspaceFileBuffer(file, { maxBytes: 1024 })).rejects.toThrow(SECRET)
+      const result = await ffmpegServerTool.execute(
+        { operation: 'convert', inputs: { files: [{ path: file.id }] } },
+        {
+          userId: ids.aliceId,
+          workspaceId: ids.workspaceId,
+          toolCallId: generateId(),
+          copilotToolExecution: true,
+          resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+          }),
+        }
+      )
+      expect(result.success).toBe(false)
+      expect(result.message).not.toContain(SECRET)
+      expect(result.message).not.toContain(storage.root)
+      await expect(
+        observeContentDelivery(
+          createRegistryContentGate({
+            registry: new ResolvedSecretTraceRegistry([], {
+              userId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+            actorUserId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+          }),
+          () =>
+            readWorkspaceFileContent.execute({
+              principal: createCopilotChatPrincipal(
+                { userId: ids.aliceId, workspaceId: ids.workspaceId },
+                WORKSPACE_FILES_DELEGATION_AUDIENCE
+              ),
+              input: { fileId: file.id },
+            })
+        )
+      ).rejects.toThrow(
+        classification === 'known'
+          ? 'File content could not be read'
+          : 'File cannot be sent to a model because its secret provenance is unavailable'
+      )
+      await expect(
+        readWorkspaceFileContent.execute({
+          principal: { kind: 'session', userId: ids.aliceId, sessionId: generateId() },
+          input: { fileId: file.id, includeSecretProvenance: true },
+        })
+      ).rejects.toThrow(SECRET)
+    }
+  )
+
+  it.each(['known', 'unknown'] as const)(
+    'persists the %s evidence of the bytes read after reference resolution',
+    async (classification) => {
+      const file = await uploadWorkspaceFile(
+        ids.workspaceId,
+        ids.aliceId,
+        Buffer.from('public version one'),
+        `input-${generateId()}.bin`,
+        'application/octet-stream',
+        { secretProvenance: CLEAN, notifyWorkspaceChange: false }
+      )
+      const provenance = classification === 'known' ? known : { status: 'unknown' as const }
+      const execute = readWorkspaceFileContent.execute
+      const pause = vi
+        .spyOn(readWorkspaceFileContent, 'execute')
+        .mockImplementationOnce(async (args) => {
+          await replace(file.id, SECRET, provenance)
+          return execute(args)
+        })
+      try {
+        const result = await ffmpegServerTool.execute(
+          {
+            operation: 'convert',
+            inputs: { files: [{ path: `files/${file.name}` }] },
+            outputs: { files: [{ path: `files/output-${generateId()}.bin` }] },
+          },
+          {
+            userId: ids.aliceId,
+            workspaceId: ids.workspaceId,
+            toolCallId: generateId(),
+            copilotToolExecution: true,
+            resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+              userId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+          }
+        )
+        expect(result.success, result.message).toBe(true)
+        if (!result.fileId) throw new Error('No output file was persisted')
+        const output = await getWorkspaceFile(ids.workspaceId, result.fileId)
+        if (!output) throw new Error('Output file cannot be read back')
+        expect((await fetchWorkspaceFileBuffer(output, { maxBytes: output.size })).toString()).toBe(
+          SECRET
+        )
+        expect(
+          await getBoundWorkspaceFileSecretProvenance(ids.workspaceId, {
+            fileId: output.id,
+            key: output.key,
+            context: output.storageContext ?? 'workspace',
+            contentUpdatedAt: output.contentUpdatedAt ?? undefined,
+          })
+        ).toEqual(provenance)
+      } finally {
+        pause.mockRestore()
+      }
+    }
+  )
+
+  it('returns the captured version evidence when a replacement commits during its storage read', async () => {
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from(SECRET),
+      `input-${generateId()}.bin`,
+      'application/octet-stream',
+      { secretProvenance: known, notifyWorkspaceChange: false }
+    )
+    const fetchContent = workspaceReader.fetchWorkspaceFileBuffer
+    const pause = vi
+      .spyOn(workspaceReader, 'fetchWorkspaceFileBuffer')
+      .mockImplementationOnce(async (...args) => {
+        const bytes = await fetchContent(...args)
+        await replace(file.id, 'public replacement', CLEAN)
+        return bytes
+      })
+    try {
+      const result = await readWorkspaceFileContent.execute({
+        principal: { kind: 'session', userId: ids.aliceId, sessionId: generateId() },
+        input: {
+          fileId: file.id,
+          assertedWorkspaceId: ids.workspaceId,
+          includeSecretProvenance: true,
+        },
+      })
+      expect(result.content.toString()).toBe(SECRET)
+      expect(result.file.key).toBe(file.key)
+      expect(result.secretProvenance).toEqual(known)
+    } finally {
+      pause.mockRestore()
+    }
+  })
+})
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
new file mode 100644
index 00000000000..2f85e7c1452
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
@@ -0,0 +1,875 @@
+{
+  "GET /api/v2/workspaces": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "color": "#33C482",
+          "createdAt": "<time>",
+          "id": "<workspace>",
+          "logoUrl": null,
+          "memberCount": 2,
+          "name": "ACL integration fixture",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:clean>",
+          "key": "<minted>",
+          "name": "clean.txt",
+          "size": 50,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:clean>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:entries>",
+          "key": "<minted>",
+          "name": "entries.txt",
+          "size": 64,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:entries>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:unknown>",
+          "key": "<minted>",
+          "name": "unknown.txt",
+          "size": 56,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:unknown>"
+        },
+        {
+          "deletedAt": null,
+          "folderPath": "/",
+          "id": "<file:unrecorded>",
+          "key": "<minted>",
+          "name": "unrecorded.txt",
+          "size": 59,
+          "type": "text/plain",
+          "updatedAt": "<time>",
+          "uploadedAt": "<time>",
+          "uploadedByEmail": "<alice>@fixture.test",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/files/<file:unrecorded>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+  },
+  "GET /api/v2/files/<file:clean>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 50,
+        "charCount": 50,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:clean>",
+        "name": "clean.txt",
+        "path": "files/clean.txt",
+        "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:clean>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:clean>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 50,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+  },
+  "GET /api/v2/files/<file:entries>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 64,
+        "charCount": 64,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:entries>",
+        "name": "entries.txt",
+        "path": "files/entries.txt",
+        "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:entries>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:entries>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 64,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+  },
+  "GET /api/v2/files/<file:unknown>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 56,
+        "charCount": 56,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:unknown>",
+        "name": "unknown.txt",
+        "path": "files/unknown.txt",
+        "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:unknown>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:unknown>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 56,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/<file:unrecorded>?workspaceId=<workspace>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line"
+  },
+  "GET /api/v2/files/<file:unrecorded>/text?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "byteCount": 59,
+        "charCount": 59,
+        "degraded": false,
+        "degradedReason": null,
+        "fileId": "<file:unrecorded>",
+        "name": "unrecorded.txt",
+        "path": "files/unrecorded.txt",
+        "text": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line",
+        "truncated": false,
+        "type": "text/plain"
+      }
+    }
+  },
+  "GET /api/v2/files/<file:unrecorded>/versions?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "authors": [
+            {
+              "email": "<alice>@fixture.test",
+              "id": "<alice>"
+            }
+          ],
+          "contentType": "text/plain",
+          "createdAt": "<time>",
+          "fileId": "<file:unrecorded>",
+          "isCurrent": true,
+          "restoredFromVersion": null,
+          "size": 59,
+          "source": "upload",
+          "supersededAt": null,
+          "updatedAt": "<time>",
+          "version": 1
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/files/bulk-download?workspaceId=<workspace>&fileIds=<file:clean>,<file:entries>,<file:unknown>,<file:unrecorded>": {
+    "status": 200,
+    "contentType": "application/zip",
+    "zip": {
+      "clean.txt": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+      "entries.txt": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+      "unknown.txt": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+      "unrecorded.txt": "untracked upload UNRECORDED_PROVENANCE_TEXT_4M8\nsecond line"
+    }
+  },
+  "GET /api/v2/files/search?workspaceId=<workspace>&query=second%20line&mode=exact": {
+    "status": 200,
+    "json": {
+      "data": {
+        "complete": true,
+        "count": 4,
+        "indexStatus": {
+          "failedFiles": 0,
+          "partialFiles": 0,
+          "pendingFiles": 0,
+          "readyFiles": 4,
+          "skippedFiles": 0
+        },
+        "results": [
+          {
+            "fileId": "<file:clean>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:entries>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:unknown>",
+            "lineNumber": 2,
+            "text": "second line"
+          },
+          {
+            "fileId": "<file:unrecorded>",
+            "lineNumber": 2,
+            "text": "second line"
+          }
+        ],
+        "truncated": false
+      }
+    }
+  },
+  "PATCH /api/v2/files/<file:unknown>/share": {
+    "status": 200,
+    "json": {
+      "data": {
+        "allowedEmails": [],
+        "authType": "public",
+        "hasPassword": false,
+        "id": "<id>",
+        "isActive": true,
+        "resourceId": "<file:unknown>",
+        "resourceType": "file",
+        "token": "<minted>",
+        "url": "http://localhost:3000/f/<minted>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "chunkingConfig": {
+            "maxSize": 1024,
+            "minSize": 1,
+            "overlap": 20
+          },
+          "connectorTypes": ["confluence"],
+          "createdAt": "<time>",
+          "deletedAt": null,
+          "description": null,
+          "docCount": 1,
+          "embeddingDimension": 1536,
+          "embeddingModel": "text-embedding-3-small",
+          "folderPath": "/",
+          "id": "<kb>",
+          "name": "Search fixture",
+          "ownerEmail": "<alice>@fixture.test",
+          "tokenCount": 0,
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/knowledge/<kb>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "characterCount": 0,
+          "chunkCount": 0,
+          "createdAt": "<time>",
+          "enabled": true,
+          "fileSize": 64,
+          "filename": "fixture.txt",
+          "id": "<document>",
+          "knowledgeBaseId": "<kb>",
+          "mimeType": "text/plain",
+          "processingStatus": "completed",
+          "tags": {},
+          "tokenCount": 0
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "characterCount": 0,
+        "chunkCount": 0,
+        "connectorId": null,
+        "connectorType": null,
+        "createdAt": "<time>",
+        "enabled": true,
+        "fileSize": 64,
+        "filename": "fixture.txt",
+        "id": "<document>",
+        "knowledgeBaseId": "<kb>",
+        "mimeType": "text/plain",
+        "processingCompletedAt": null,
+        "processingError": null,
+        "processingStartedAt": null,
+        "processingStatus": "completed",
+        "sourceUrl": null,
+        "tags": {},
+        "tokenCount": 0
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "chunkIndex": 0,
+          "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+          "contentLength": 50,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 50,
+          "id": "<chunk:clean>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        },
+        {
+          "chunkIndex": 1,
+          "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+          "contentLength": 64,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 64,
+          "id": "<chunk:entries>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        },
+        {
+          "chunkIndex": 2,
+          "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+          "contentLength": 56,
+          "createdAt": "<time>",
+          "enabled": true,
+          "endOffset": 56,
+          "id": "<chunk:unknown>",
+          "startOffset": 0,
+          "tag1": null,
+          "tag2": null,
+          "tag3": null,
+          "tag4": null,
+          "tag5": null,
+          "tag6": null,
+          "tag7": null,
+          "tokenCount": 8,
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 0,
+        "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+        "contentLength": 50,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 50,
+        "id": "<chunk:clean>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 1,
+        "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+        "contentLength": 64,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 64,
+        "id": "<chunk:entries>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/knowledge/<kb>/documents/<document>/chunks/<chunk:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "chunkIndex": 2,
+        "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+        "contentLength": 56,
+        "createdAt": "<time>",
+        "enabled": true,
+        "endOffset": 56,
+        "id": "<chunk:unknown>",
+        "startOffset": 0,
+        "tag1": null,
+        "tag2": null,
+        "tag3": null,
+        "tag4": null,
+        "tag5": null,
+        "tag6": null,
+        "tag7": null,
+        "tokenCount": 8,
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "POST /api/v2/knowledge/search": {
+    "status": 200,
+    "json": {
+      "data": {
+        "knowledgeBaseIds": ["<kb>"],
+        "query": "second line",
+        "rerankerStatus": "not_requested",
+        "results": [
+          {
+            "chunkIndex": 0,
+            "content": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          },
+          {
+            "chunkIndex": 1,
+            "content": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          },
+          {
+            "chunkIndex": 2,
+            "content": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line",
+            "documentId": "<document>",
+            "documentName": "fixture.txt",
+            "knowledgeBaseId": "<kb>",
+            "metadata": {},
+            "rank": "<minted>",
+            "rankScore": "<minted>",
+            "similarity": "<minted>",
+            "sourceUrl": null
+          }
+        ],
+        "topK": 10,
+        "totalResults": 3
+      }
+    }
+  },
+  "GET /api/v2/tables?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "description": null,
+          "folderPath": "/",
+          "id": "<table>",
+          "job": null,
+          "locks": {
+            "deleteLocked": false,
+            "insertLocked": false,
+            "schemaLocked": false,
+            "updateLocked": false
+          },
+          "maxRows": 9007199254740991,
+          "name": "content_fixture",
+          "ownerEmail": "<alice>@fixture.test",
+          "rowCount": "<minted>",
+          "schema": {
+            "columns": [
+              {
+                "id": "<id>",
+                "name": "note",
+                "required": false,
+                "type": "string",
+                "unique": false
+              }
+            ]
+          },
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/tables/<table>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/tables/<table>/rows?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+          },
+          "id": "<row:clean>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+          },
+          "id": "<row:entries>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+          },
+          "id": "<row:unknown>",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:clean>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+        },
+        "id": "<row:clean>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:entries>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+        },
+        "id": "<row:entries>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "GET /api/v2/tables/<table>/rows/<row:unknown>?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": {
+        "createdAt": "<time>",
+        "data": {
+          "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+        },
+        "id": "<row:unknown>",
+        "updatedAt": "<time>"
+      }
+    }
+  },
+  "POST /api/v2/tables/<table>/query": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+          },
+          "id": "<row:clean>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+          },
+          "id": "<row:entries>",
+          "updatedAt": "<time>"
+        },
+        {
+          "createdAt": "<time>",
+          "data": {
+            "note": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+          },
+          "id": "<row:unknown>",
+          "updatedAt": "<time>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "POST /api/v2/tables/<table>/rows/search": {
+    "status": 200,
+    "json": {
+      "data": {
+        "matches": [
+          {
+            "column": "note",
+            "ordinal": 0,
+            "rowId": "<row:clean>"
+          },
+          {
+            "column": "note",
+            "ordinal": 1,
+            "rowId": "<row:entries>"
+          },
+          {
+            "column": "note",
+            "ordinal": 2,
+            "rowId": "<row:unknown>"
+          }
+        ],
+        "truncated": false
+      }
+    }
+  },
+  "GET /api/v2/workflows?workspaceId=<workspace>": {
+    "status": 200,
+    "json": {
+      "data": [
+        {
+          "createdAt": "<time>",
+          "deployedAt": null,
+          "description": null,
+          "folderPath": "/",
+          "id": "<workflow>",
+          "isDeployed": false,
+          "lastRunAt": null,
+          "name": "content fixture <workflow>",
+          "runCount": 0,
+          "updatedAt": "<time>",
+          "webUrl": "http://localhost:3000/workspace/<workspace>/w/<workflow>",
+          "workspaceId": "<workspace>"
+        }
+      ],
+      "nextCursor": null
+    }
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>?includeOutput=true&includeFileBase64=true": {
+    "status": 200,
+    "json": {
+      "data": {
+        "blockOutputs": null,
+        "cost": null,
+        "durationMs": null,
+        "endedAt": "<time>",
+        "error": null,
+        "files": [
+          {
+            "base64": "cHVibGljIG5vdGVzIENMRUFOX1BST1ZFTkFOQ0VfVEVYVF85SzEKc2Vjb25kIGxpbmU=",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:clean>",
+            "id": "<run-file:clean>",
+            "name": "clean.txt",
+            "size": 50,
+            "type": "text/plain"
+          },
+          {
+            "base64": "Y29uZmlnIHRva2VuPXNrX2xpdmVfRklYVFVSRV9FTlRSWV9TRUNSRVRfMDEyMzQ1Njc4OQpzZWNvbmQgbGluZQ==",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:entries>",
+            "id": "<run-file:entries>",
+            "name": "entries.txt",
+            "size": 64,
+            "type": "text/plain"
+          },
+          {
+            "base64": "dGFpbnRlZCBleHBvcnQgVU5LTk9XTl9QUk9WRU5BTkNFX0NBTkFSWV83UTIKc2Vjb25kIGxpbmU=",
+            "downloadPath": "/api/v2/workflows/<workflow>/runs/<run>/files/<run-file:unknown>",
+            "id": "<run-file:unknown>",
+            "name": "unknown.txt",
+            "size": 56,
+            "type": "text/plain"
+          }
+        ],
+        "output": {
+          "clean": {
+            "context": "execution",
+            "id": "<run-file:clean>",
+            "key": "<minted>",
+            "name": "clean.txt",
+            "size": 50,
+            "type": "text/plain",
+            "url": "http://localhost:3000/api/files/serve/<minted>"
+          },
+          "entries": {
+            "context": "execution",
+            "id": "<run-file:entries>",
+            "key": "<minted>",
+            "name": "entries.txt",
+            "size": 64,
+            "type": "text/plain",
+            "url": "http://localhost:3000/api/files/serve/<minted>"
+          },
+          "unknown": {
+            "context": "execution",
+            "id": "<run-file:unknown>",
+            "key": "<minted>",
+            "name": "unknown.txt",
+            "size": 56,
+            "type": "text/plain",
+            "url": "http://localhost:3000/api/files/serve/<minted>"
+          }
+        },
+        "paused": null,
+        "runId": "<run>",
+        "startedAt": "<time>",
+        "status": "completed",
+        "trigger": "api",
+        "workflowId": "<workflow>"
+      }
+    }
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:clean>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "public notes CLEAN_PROVENANCE_TEXT_9K1\nsecond line"
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:entries>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "config token=sk_live_FIXTURE_ENTRY_SECRET_0123456789\nsecond line"
+  },
+  "GET /api/v2/workflows/<workflow>/runs/<run>/files/<run-file:unknown>": {
+    "status": 200,
+    "contentType": "text/plain",
+    "text": "tainted export UNKNOWN_PROVENANCE_CANARY_7Q2\nsecond line"
+  }
+}
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
new file mode 100644
index 00000000000..56bb32a31f5
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.integration.ts
@@ -0,0 +1,217 @@
+/**
+ * Non-Chat callers of every use case that gates Chat's content delivery, compared byte for byte
+ * against a snapshot recorded before the gate existed. API keys, OAuth, MCP and the UI read the
+ * same content, unclassified, whatever its secret provenance: only a Chat surface installs a gate.
+ */
+import { mkdtempSync, readFileSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
+import JSZip from 'jszip'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+/** Admission throughput is not what this suite proves. */
+vi.mock('@/lib/core/rate-limiter', () => rateLimiterMock)
+vi.mock('@/lib/embeddings', async () => ({
+  ...(await import('@/lib/embeddings/client')),
+  assertKnowledgeEmbeddingCapacity: async () => {},
+  embedKnowledge: async (texts: string[]) => ({
+    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+    totalTokens: texts.length,
+    billableTokens: 0,
+    isBYOK: true,
+    modelName: 'text-embedding-3-small',
+    pricingId: 'text-embedding-3-small',
+  }),
+}))
+
+import {
+  type ContentFixture,
+  callV2,
+  removeContentFixture,
+  seedContentFixture,
+} from '@/lib/mothership/__integration__/content-delivery-fixture'
+
+const ISO_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/
+const UUID = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi
+/** Fields whose value is minted per write: storage keys and share tokens. */
+const MINTED_FIELDS = new Set(['key', 'token'])
+
+/**
+ * A URL keeps its origin and fixed path, so a wrong host or route still fails; only the segments
+ * a write minted (tokens, storage keys: anything but lowercase words) and query values vary.
+ */
+function normalizeUrl(value: string, labels: Map<string, string>): string {
+  if (!URL.canParse(value)) return String(normalize(value, labels))
+  const url = new URL(value)
+  const path = url.pathname
+    .split('/')
+    .map((segment) => (/^[a-z-]*$/.test(segment) ? segment : '<minted>'))
+    .join('/')
+  const query = [...url.searchParams.keys()].sort().join('&')
+  return `${url.origin}${path}${query ? `?${query}` : ''}`
+}
+/**
+ * Ranking scores move with whatever else the shared test database indexed (order is pinned below),
+ * and a table's `rowCount` is maintained by a migration trigger a pushed schema does not install.
+ */
+const UNSTABLE_SCORES = new Set(['rank', 'rankScore', 'similarity', 'rowCount'])
+const MINTED_ID = /\b(?:col|row|tbl)_[0-9a-f]{32}\b/g
+
+/** Replaces values minted per run (ids, times, tokens) so two runs of the same calls compare equal. */
+function normalize(value: unknown, labels: Map<string, string>): unknown {
+  if (typeof value === 'string') {
+    if (ISO_TIME.test(value)) return '<time>'
+    let text = value
+    for (const [raw, label] of labels) text = text.split(raw).join(label)
+    return text.replace(UUID, '<id>').replace(MINTED_ID, '<id>')
+  }
+  if (Array.isArray(value)) {
+    const items = value.map((item) => normalize(item, labels))
+    return items.every((item) => typeof (item as { chunkIndex?: unknown })?.chunkIndex === 'number')
+      ? items.sort(
+          (left, right) =>
+            (left as { chunkIndex: number }).chunkIndex -
+            (right as { chunkIndex: number }).chunkIndex
+        )
+      : items
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([key, item]) => [
+          key,
+          (MINTED_FIELDS.has(key) && typeof item === 'string') || UNSTABLE_SCORES.has(key)
+            ? '<minted>'
+            : key === 'url' && typeof item === 'string'
+              ? normalizeUrl(item, labels)
+              : normalize(item, labels),
+        ])
+    )
+  }
+  return value
+}
+
+async function describeResponse(response: Response, labels: Map<string, string>) {
+  const contentType = response.headers.get('content-type') ?? ''
+  const status = response.status
+  if (contentType.includes('application/json')) {
+    return { status, json: normalize(await response.json(), labels) }
+  }
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (contentType.includes('zip')) {
+    const archive = await JSZip.loadAsync(bytes)
+    const entries: Record<string, string> = {}
+    for (const name of Object.keys(archive.files).sort()) {
+      const entry = archive.files[name]
+      if (!entry.dir) entries[name] = await entry.async('string')
+    }
+    return { status, contentType, zip: normalize(entries, labels) }
+  }
+  return { status, contentType, text: normalize(bytes.toString('utf8'), labels) }
+}
+
+/**
+ * Recorded once on the commit before Chat's delivery gate existed and compared semantically, so
+ * formatting cannot move it. It is evidence, not an expectation to regenerate: a difference here is
+ * a change non-Chat callers would see.
+ */
+const BASELINE: unknown = JSON.parse(
+  readFileSync(path.join(__dirname, 'content-delivery-compat.baseline.json'), 'utf8')
+)
+
+describe('non-Chat callers read sourced content unchanged', () => {
+  let fixture: ContentFixture
+  const labels = new Map<string, string>()
+
+  beforeAll(async () => {
+    fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-compat-'))
+    fixture = await seedContentFixture()
+    labels.set(fixture.ids.workspaceId, '<workspace>')
+    labels.set(fixture.ids.aliceId, '<alice>')
+    labels.set(fixture.ids.organizationId, '<organization>')
+    labels.set(fixture.knowledge.knowledgeBaseId, '<kb>')
+    labels.set(fixture.knowledge.documentId, '<document>')
+    labels.set(fixture.table.tableId, '<table>')
+    labels.set(fixture.run.workflowId, '<workflow>')
+    labels.set(fixture.run.runId, '<run>')
+    for (const [name, id] of Object.entries(fixture.files)) labels.set(id, `<file:${name}>`)
+    for (const [name, id] of Object.entries(fixture.knowledge.chunks))
+      labels.set(id, `<chunk:${name}>`)
+    for (const [name, id] of Object.entries(fixture.table.rows)) labels.set(id, `<row:${name}>`)
+    for (const [name, id] of Object.entries(fixture.run.files)) labels.set(id, `<run-file:${name}>`)
+  }, 120_000)
+
+  afterAll(async () => {
+    if (fixture) await removeContentFixture(fixture)
+    await rm(fixtureStorage.root, { recursive: true, force: true })
+  })
+
+  it('answers every shared content route as it did before the gate', async () => {
+    const ws = fixture.ids.workspaceId
+    const { files, knowledge, table, run } = fixture
+    const kb = `/api/v2/knowledge/${knowledge.knowledgeBaseId}`
+    const calls: Array<[string, string, unknown?]> = [
+      ['GET', '/api/v2/workspaces'],
+      ['GET', `/api/v2/files?workspaceId=${ws}`],
+      ...Object.values(files).flatMap(
+        (id): Array<[string, string]> => [
+          ['GET', `/api/v2/files/${id}?workspaceId=${ws}`],
+          ['GET', `/api/v2/files/${id}/text?workspaceId=${ws}`],
+          ['GET', `/api/v2/files/${id}/versions?workspaceId=${ws}`],
+        ]
+      ),
+      ['GET', `/api/v2/files/bulk-download?workspaceId=${ws}&fileIds=${Object.values(files)}`],
+      ['GET', `/api/v2/files/search?workspaceId=${ws}&query=second%20line&mode=exact`],
+      [
+        'PATCH',
+        `/api/v2/files/${files.unknown}/share`,
+        { workspaceId: ws, isActive: true, authType: 'public' },
+      ],
+      ['GET', `/api/v2/knowledge?workspaceId=${ws}`],
+      ['GET', `${kb}/documents?workspaceId=${ws}`],
+      ['GET', `${kb}/documents/${knowledge.documentId}?workspaceId=${ws}`],
+      ['GET', `${kb}/documents/${knowledge.documentId}/chunks?workspaceId=${ws}`],
+      ...Object.values(knowledge.chunks).map((id): [string, string] => [
+        'GET',
+        `${kb}/documents/${knowledge.documentId}/chunks/${id}?workspaceId=${ws}`,
+      ]),
+      [
+        'POST',
+        '/api/v2/knowledge/search',
+        { workspaceId: ws, knowledgeBaseIds: [knowledge.knowledgeBaseId], query: 'second line' },
+      ],
+      ['GET', `/api/v2/tables?workspaceId=${ws}`],
+      ['GET', `/api/v2/tables/${table.tableId}/rows?workspaceId=${ws}`],
+      ...Object.values(table.rows).map((id): [string, string] => [
+        'GET',
+        `/api/v2/tables/${table.tableId}/rows/${id}?workspaceId=${ws}`,
+      ]),
+      ['POST', `/api/v2/tables/${table.tableId}/query`, { workspaceId: ws }],
+      ['POST', `/api/v2/tables/${table.tableId}/rows/search`, { workspaceId: ws, q: 'second' }],
+      ['GET', `/api/v2/workflows?workspaceId=${ws}`],
+      [
+        'GET',
+        `/api/v2/workflows/${run.workflowId}/runs/${run.runId}?includeOutput=true&includeFileBase64=true`,
+      ],
+      ...Object.values(run.files).map((id): [string, string] => [
+        'GET',
+        `/api/v2/workflows/${run.workflowId}/runs/${run.runId}/files/${id}`,
+      ]),
+    ]
+    const observed: Record<string, unknown> = {}
+    for (const [method, route, body] of calls) {
+      const key = `${method} ${normalize(route, labels)}`
+      observed[key] = await describeResponse(await callV2(fixture, method, route, body), labels)
+    }
+    expect(observed).toEqual(BASELINE)
+  }, 120_000)
+})
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
new file mode 100644
index 00000000000..7b8131ccdb9
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-fixture.ts
@@ -0,0 +1,379 @@
+import { createHash } from 'node:crypto'
+import { db } from '@sim/db'
+import {
+  apiKey,
+  auditLog,
+  document,
+  embedding,
+  embeddingSecretProvenance,
+  knowledgeConnector,
+  organization,
+  user,
+  userTableRowSecretProvenance,
+  userTableRows,
+  workflow,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
+  workspace,
+  workspaceFileSearchRevision,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { NextRequest } from 'next/server'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { hashApiKey } from '@/lib/api-key/crypto'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { embeddingVectorValues } from '@/lib/knowledge/vector-columns'
+import { uploadExecutionFile } from '@/lib/uploads/contexts/execution/execution-file-manager'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
+
+export const ORIGIN = 'http://localhost:3000'
+
+/** A literal no store vouches for: every canary is one of these, so a leak names its source. */
+export const CANARY = {
+  unknown: 'UNKNOWN_PROVENANCE_CANARY_7Q2',
+  unrecorded: 'UNRECORDED_PROVENANCE_TEXT_4M8',
+  clean: 'CLEAN_PROVENANCE_TEXT_9K1',
+  secret: 'sk_live_FIXTURE_ENTRY_SECRET_0123456789',
+} as const
+
+/** Classifications every content store is seeded with, one item each. */
+type SeededClassification = 'clean' | 'entries' | 'unknown' | 'unrecorded'
+
+export interface ContentFixture {
+  ids: ReturnType<typeof createKnowledgeAclFixtureIds>
+  personalKey: string
+  files: Record<SeededClassification, string>
+  knowledge: {
+    knowledgeBaseId: string
+    documentId: string
+    chunks: Record<Exclude<SeededClassification, 'unrecorded'>, string>
+  }
+  table: { tableId: string; rows: Record<Exclude<SeededClassification, 'unrecorded'>, string> }
+  run: {
+    workflowId: string
+    runId: string
+    files: Record<Exclude<SeededClassification, 'unrecorded'>, string>
+  }
+}
+
+function sha256(value: string): string {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+/** The text each seeded item holds: the canary its classification names, beside shared prose. */
+function seededText(classification: SeededClassification): string {
+  switch (classification) {
+    case 'clean':
+      return `public notes ${CANARY.clean}\nsecond line`
+    case 'entries':
+      return `config token=${CANARY.secret}\nsecond line`
+    case 'unknown':
+      return `tainted export ${CANARY.unknown}\nsecond line`
+    case 'unrecorded':
+      return `untracked upload ${CANARY.unrecorded}\nsecond line`
+  }
+}
+
+async function exactEntries(ids: ContentFixture['ids']) {
+  return [
+    {
+      encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+      sourceUserId: ids.aliceId,
+      sourceWorkspaceId: ids.workspaceId,
+      name: 'FIXTURE_TOKEN',
+    },
+  ]
+}
+
+/**
+ * Invokes a generated v2 route exactly as a deployed request reaches it: the real handler,
+ * authenticated by the fixture's personal API key.
+ */
+export async function callV2(
+  fixture: Pick<ContentFixture, 'personalKey'>,
+  method: string,
+  path: string,
+  body?: unknown
+): Promise<Response> {
+  const url = new URL(path, ORIGIN)
+  const matched = matchV2Route(url.pathname)
+  if (!matched) throw new Error(`No v2 route for ${url.pathname}`)
+  const handler = Reflect.get(await matched.load(), method)
+  if (typeof handler !== 'function') throw new Error(`No ${method} handler for ${url.pathname}`)
+  const request = new NextRequest(url, {
+    method,
+    headers: {
+      'x-api-key': fixture.personalKey,
+      'x-forwarded-for': '127.0.0.1',
+      ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  })
+  const response: unknown = await handler(request, { params: Promise.resolve(matched.params) })
+  if (!(response instanceof Response)) throw new Error('Route returned no response')
+  return response
+}
+
+async function seedFiles(ids: ContentFixture['ids']): Promise<ContentFixture['files']> {
+  const provenance: Record<SeededClassification, WorkspaceFileSecretProvenance> = {
+    clean: { status: 'exact', entries: [] },
+    entries: { status: 'exact', entries: await exactEntries(ids) },
+    unknown: { status: 'unknown' },
+    unrecorded: { status: 'unrecorded' },
+  }
+  const files = {} as ContentFixture['files']
+  for (const classification of ['clean', 'entries', 'unknown', 'unrecorded'] as const) {
+    const file = await uploadWorkspaceFile(
+      ids.workspaceId,
+      ids.aliceId,
+      Buffer.from(seededText(classification)),
+      `${classification}.txt`,
+      'text/plain',
+      { secretProvenance: provenance[classification], notifyWorkspaceChange: false }
+    )
+    files[classification] = file.id
+    const dispatchedAt = new Date()
+    const sourceContentUpdatedAt = file.contentUpdatedAt ?? new Date()
+    await db
+      .insert(workspaceFileSearchRevision)
+      .values({
+        fileId: file.id,
+        workspaceId: ids.workspaceId,
+        sourceContentUpdatedAt,
+        status: 'pending',
+        dispatchedAt,
+      })
+      .onConflictDoUpdate({
+        target: workspaceFileSearchRevision.fileId,
+        set: { status: 'pending', dispatchedAt, sourceContentUpdatedAt, buildId: null },
+      })
+    await indexWorkspaceFileForSearch(
+      {
+        workspaceId: ids.workspaceId,
+        fileId: file.id,
+        sourceContentUpdatedAt: sourceContentUpdatedAt.toISOString(),
+        dispatchToken: dispatchedAt.toISOString(),
+      },
+      new AbortController().signal
+    )
+  }
+  return files
+}
+
+async function seedKnowledge(ids: ContentFixture['ids']): Promise<ContentFixture['knowledge']> {
+  const documentId = generateId()
+  await db.insert(document).values({
+    id: documentId,
+    knowledgeBaseId: ids.knowledgeBaseId,
+    filename: 'fixture.txt',
+    fileUrl: `https://fixture.invalid/${documentId}`,
+    fileSize: 64,
+    mimeType: 'text/plain',
+    processingStatus: 'completed',
+    acl: ['ws'],
+    aclRequirements: [],
+    aclVerifiedAt: new Date(),
+  })
+  const entries = await exactEntries(ids)
+  const chunks = {} as ContentFixture['knowledge']['chunks']
+  let chunkIndex = 0
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const id = generateId()
+    const content = seededText(classification)
+    await db.insert(embedding).values({
+      id,
+      documentId,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      chunkIndex: chunkIndex++,
+      chunkHash: sha256(content),
+      content,
+      contentLength: content.length,
+      tokenCount: 8,
+      startOffset: 0,
+      endOffset: content.length,
+      embeddingModel: 'text-embedding-3-small',
+      ...embeddingVectorValues(1536, [1, chunkIndex / 10, ...Array<number>(1534).fill(0)]),
+      ...(classification === 'clean' ? {} : { secretProvenanceVersion: 1 }),
+    })
+    if (classification === 'entries') {
+      await db.insert(embeddingSecretProvenance).values({
+        embeddingId: id,
+        contentHash: sha256(content),
+        status: 'exact',
+        entries,
+      })
+    }
+    chunks[classification] = id
+  }
+  return { knowledgeBaseId: ids.knowledgeBaseId, documentId, chunks }
+}
+
+async function seedTable(
+  fixture: Pick<ContentFixture, 'personalKey' | 'ids'>
+): Promise<ContentFixture['table']> {
+  const workspaceId = fixture.ids.workspaceId
+  const created = await callV2(fixture, 'POST', '/api/v2/tables', {
+    workspaceId,
+    name: 'content_fixture',
+    schema: { columns: [{ name: 'note', type: 'string' }] },
+  })
+  if (created.status !== 201) throw new Error(`Table fixture failed: ${await created.text()}`)
+  const tableId: string = (await created.json()).data.id
+  const rows = {} as ContentFixture['table']['rows']
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const inserted = await callV2(fixture, 'POST', `/api/v2/tables/${tableId}/rows`, {
+      workspaceId,
+      data: { note: seededText(classification) },
+    })
+    if (inserted.status !== 201) throw new Error(`Row fixture failed: ${await inserted.text()}`)
+    rows[classification] = (await inserted.json()).data.id
+  }
+  /** Cells are stored by column id; the sidecar names the one column the secret is in. */
+  const [stored] = await db
+    .select({ data: userTableRows.data })
+    .from(userTableRows)
+    .where(eq(userTableRows.id, rows.entries))
+  const [columnId] = Object.keys(stored?.data ?? {})
+  if (!columnId) throw new Error('Row fixture stored no cells')
+  const columnEntries = (await exactEntries(fixture.ids)).map((entry) => ({ ...entry, columnId }))
+  /** v2 inserts already bind an exact-empty sidecar; only its classification is rewritten. */
+  await db
+    .update(userTableRowSecretProvenance)
+    .set({ entries: columnEntries })
+    .where(eq(userTableRowSecretProvenance.rowId, rows.entries))
+  await db
+    .update(userTableRowSecretProvenance)
+    .set({ status: 'unknown' })
+    .where(eq(userTableRowSecretProvenance.rowId, rows.unknown))
+  return { tableId, rows }
+}
+
+async function seedRun(ids: ContentFixture['ids']): Promise<ContentFixture['run']> {
+  const workflowId = generateId()
+  const runId = generateId()
+  const snapshotId = generateId()
+  const now = new Date()
+  await db.insert(workflow).values({
+    id: workflowId,
+    userId: ids.aliceId,
+    workspaceId: ids.workspaceId,
+    name: `content fixture ${workflowId}`,
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(workflowExecutionSnapshots).values({
+    id: snapshotId,
+    workflowId,
+    stateHash: snapshotId,
+    stateData: {},
+  })
+  const context = { workspaceId: ids.workspaceId, workflowId, executionId: runId }
+  const entries = await exactEntries(ids)
+  const provenance = {
+    clean: { status: 'exact', entries: [] },
+    entries: { status: 'exact', entries },
+    unknown: { status: 'unknown' },
+  } as const
+  const outputs: Record<string, unknown> = {}
+  const files = {} as ContentFixture['run']['files']
+  for (const classification of ['clean', 'entries', 'unknown'] as const) {
+    const file = await uploadExecutionFile(
+      context,
+      Buffer.from(seededText(classification)),
+      `${classification}.txt`,
+      'text/plain',
+      ids.aliceId,
+      provenance[classification]
+    )
+    files[classification] = file.id
+    outputs[classification] = file
+  }
+  await db.insert(workflowExecutionLogs).values({
+    id: generateId(),
+    workflowId,
+    workspaceId: ids.workspaceId,
+    executionId: runId,
+    stateSnapshotId: snapshotId,
+    level: 'info',
+    status: 'completed',
+    trigger: 'api',
+    startedAt: now,
+    endedAt: now,
+    executionData: { finalOutput: outputs, traceSpans: [] },
+  })
+  return { workflowId, runId, files }
+}
+
+/** One workspace holding a clean, a secret-bearing, an unknown and an unrecorded item per store. */
+export async function seedContentFixture(): Promise<ContentFixture> {
+  const ids = createKnowledgeAclFixtureIds()
+  await seedKnowledgeAclFixture(ids)
+  const personalKey = `sk-sim-fixture-${generateId()}`
+  await db.insert(apiKey).values({
+    id: generateId(),
+    userId: ids.aliceId,
+    name: 'Content fixture',
+    key: personalKey,
+    keyHash: hashApiKey(personalKey),
+    type: 'personal',
+  })
+  const files = await seedFiles(ids)
+  const knowledge = await seedKnowledge(ids)
+  const table = await seedTable({ ids, personalKey })
+  const run = await seedRun(ids)
+  return { ids, personalKey, files, knowledge, table, run }
+}
+
+export async function removeContentFixture(fixture: ContentFixture): Promise<void> {
+  const { ids } = fixture
+  await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+  await db
+    .delete(workflowExecutionLogs)
+    .where(eq(workflowExecutionLogs.workspaceId, ids.workspaceId))
+  await db
+    .delete(workflowExecutionSnapshots)
+    .where(eq(workflowExecutionSnapshots.workflowId, fixture.run.workflowId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+  await db.delete(organization).where(eq(organization.id, ids.organizationId))
+  await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+}
+
+/**
+ * Adds a document a connector synced, so a connector listing has a row to classify. Kept out of
+ * the shared seed, whose non-Chat responses the compat baseline records.
+ */
+export async function seedKnowledgeConnector(
+  fixture: ContentFixture
+): Promise<{ connectorId: string; documentId: string }> {
+  const connectorId = generateId()
+  await db.insert(knowledgeConnector).values({
+    id: connectorId,
+    knowledgeBaseId: fixture.knowledge.knowledgeBaseId,
+    connectorType: 'fixture',
+    sourceConfig: {},
+  })
+  const documentId = generateId()
+  await db.insert(document).values({
+    id: documentId,
+    knowledgeBaseId: fixture.knowledge.knowledgeBaseId,
+    connectorId,
+    filename: 'synced.txt',
+    fileUrl: `https://fixture.invalid/${documentId}`,
+    fileSize: 64,
+    mimeType: 'text/plain',
+    processingStatus: 'completed',
+    acl: ['ws'],
+    aclRequirements: [],
+    aclVerifiedAt: new Date(),
+  })
+  return { connectorId, documentId }
+}
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
new file mode 100644
index 00000000000..3eff379a761
--- /dev/null
+++ b/apps/sim/lib/mothership/__integration__/content-delivery.integration.ts
@@ -0,0 +1,1587 @@
+/**
+ * Every Chat surface that can carry content from a provenance-bearing store, driven through the
+ * real composition: Chat's CLI transport and the run_code sandbox proxy, the real routes and use
+ * cases, real PostgreSQL and Redis. Each store holds one clean, one secret-bearing, one unknown and
+ * (for files) one unrecorded item, so every case shows the per-item decision side by side.
+ */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import { featureFlagsMock, featureFlagsMockFns } from '@sim/testing/mocks/feature-flags.mock'
+import { rateLimiterMock } from '@sim/testing/mocks/rate-limiter.mock'
+import { generateId } from '@sim/utils/id'
+import JSZip from 'jszip'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtureStorage = vi.hoisted(() => {
+  if (process.env.TEST_REDIS_URL) process.env.REDIS_URL = process.env.TEST_REDIS_URL
+  return { root: '' }
+})
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtureStorage.root
+  },
+}))
+/** Admission throughput is not what this suite proves. */
+vi.mock('@/lib/core/rate-limiter', () => rateLimiterMock)
+vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
+vi.mock('@/lib/embeddings', async () => ({
+  ...(await import('@/lib/embeddings/client')),
+  assertKnowledgeEmbeddingCapacity: async () => {},
+  embedKnowledge: async (texts: string[]) => ({
+    embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+    totalTokens: texts.length,
+    billableTokens: 0,
+    isBYOK: true,
+    modelName: 'text-embedding-3-small',
+    pricingId: 'text-embedding-3-small',
+  }),
+}))
+/** The remote workbench itself is a third-party machine; only its identity is needed here. */
+const workbench = vi.hoisted(() => ({ available: true }))
+vi.mock('@/lib/execution/remote-sandbox/provider', () => ({
+  resolveProvider: () => ({
+    id: 'e2b',
+    findSessionSandbox: async () => (workbench.available ? { sandboxId: 'fixture-sandbox' } : null),
+  }),
+}))
+/** The run lease that owns a sandbox token is the tool executor's concern, not this boundary's. */
+vi.mock('@/lib/mothership/async-runs/repository', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/mothership/async-runs/repository')>()),
+  isActiveSandboxResourceOwner: async () => true,
+}))
+
+/** Provider bytes are synthetic; generic-tool execution and its private metadata consumer are real. */
+const toolProvider = vi.hoisted(() => ({ response: undefined as Response | undefined }))
+vi.mock('@/lib/internal/tool-operations/registry.server', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/lib/internal/tool-operations/registry.server')>()
+  return {
+    ...actual,
+    getInternalToolOperationHandler: async (toolId: string) => {
+      if (toolId === 'file_get_content' && toolProvider.response) {
+        const response = toolProvider.response
+        return async () => response
+      }
+      return actual.getInternalToolOperationHandler(toolId)
+    },
+  }
+})
+
+/** Only the external media providers are replaced; file admission and stored revisions are real. */
+const mediaProvider = vi.hoisted(() => ({ calls: [] as unknown[] }))
+vi.mock('@google/genai', () => ({
+  GoogleGenAI: class {
+    models = {
+      async generateContent(input: unknown) {
+        mediaProvider.calls.push(input)
+        throw new Error('fixture media provider reached')
+      },
+    }
+  },
+}))
+vi.mock('@/lib/core/config/api-keys', () => ({ getRotatingApiKey: () => 'fixture-api-key' }))
+vi.mock('@/lib/media/falai-audio', () => ({
+  async generateFalAudio(input: unknown) {
+    mediaProvider.calls.push(input)
+    throw new Error('fixture media provider reached')
+  },
+}))
+vi.mock('@/lib/media/falai-video', () => ({
+  async generateFalVideo(input: unknown) {
+    mediaProvider.calls.push(input)
+    throw new Error('fixture media provider reached')
+  },
+}))
+
+import { db } from '@sim/db'
+import {
+  changelogRelease,
+  copilotChats,
+  userTableRowSecretProvenance,
+  workflowTest,
+  workspaceFileSearchRevision,
+  workspaceFiles,
+} from '@sim/db/schema'
+import { sha256Hex } from '@sim/security/hash'
+import { eq, sql } from 'drizzle-orm'
+import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { observeContentDelivery } from '@/lib/core/application'
+import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
+import { getRedisClient } from '@/lib/core/config/redis'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  RESOLVED_SECRET_PROVENANCE_METADATA_V1,
+  serializePrivateToolMetadataResponseEnvelope,
+} from '@/lib/execution/private-tool-metadata'
+import {
+  initializeSessionFileProvenance,
+  readSessionSecretProvenance,
+} from '@/lib/execution/remote-sandbox/session-file-provenance'
+import {
+  CANARY,
+  type ContentFixture,
+  callV2,
+  ORIGIN,
+  removeContentFixture,
+  seedContentFixture,
+  seedKnowledgeConnector,
+} from '@/lib/mothership/__integration__/content-delivery-fixture'
+import { observePrivateFile } from '@/lib/mothership/agent-cli/engines/observe-private-file'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { resolveServableDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { generateImageServerTool } from '@/lib/mothership/tools/server/image/generate-image'
+import { generateAudioServerTool } from '@/lib/mothership/tools/server/media/generate-audio'
+import { generateVideoServerTool } from '@/lib/mothership/tools/server/media/generate-video'
+import { getShareForResource } from '@/lib/public-shares/share-manager'
+import {
+  createOwnedWorkspaceFile,
+  getWorkspaceFile,
+  updateWorkspaceFileContent as replaceFixtureFileContent,
+  uploadWorkspaceFile,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import {
+  getWorkspaceFileShares,
+  updateWorkspaceFileShare,
+} from '@/lib/workspace-files/application/share-workspace-file'
+import { storeCompiledDoc } from '@/lib/workspace-files/compiled-document-store'
+import { indexWorkspaceFileForSearch } from '@/lib/workspace-files/search/indexing'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const WORKBENCH = { providerId: 'e2b', sandboxId: 'fixture-sandbox' } as const
+
+interface ChatRead {
+  status: number
+  /** The body as text; a zip is flattened to `name: content` lines. */
+  body: string
+  registry: ResolvedSecretTraceRegistry
+}
+
+/** What Chat's model receives: the body projected through the call's registry, as egress does. */
+function modelView(read: ChatRead): string | undefined {
+  const projection = projectResolvedSecretModelContent(
+    read.body,
+    read.registry.forkForPropagatedEntries()
+  )
+  return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
+}
+
+async function bodyText(response: Response): Promise<string> {
+  const bytes = Buffer.from(await response.arrayBuffer())
+  if (!(response.headers.get('content-type') ?? '').includes('zip')) return bytes.toString('utf8')
+  const archive = await JSZip.loadAsync(bytes)
+  const lines: string[] = []
+  for (const name of Object.keys(archive.files).sort()) {
+    if (!archive.files[name].dir)
+      lines.push(`${name}: ${await archive.files[name].async('string')}`)
+  }
+  return lines.join('\n')
+}
+
+/**
+ * Routes Chat may call whose content is not driven through a transport here, each with the
+ * test that proves its gate instead. Running a workflow needs a deployed workflow and an executor;
+ * the inline file bytes it returns are withheld by the same helper the run read uses, proven here.
+ */
+const PROVEN_ELSEWHERE: Record<string, string> = {
+  'POST /api/v2/workflows/[workflowId]/execute':
+    'lib/workflows/application/admit-run-files.test.ts (withholdUnadmittedInlineFiles)',
+  'POST /api/v2/workflows/[workflowId]/runs/[runId]/resume':
+    'lib/workflows/application/admit-run-files.test.ts (withholdUnadmittedInlineFiles)',
+}
+
+/** Each content route a case drove, as `METHOD /api/v2/...` in the inventory's `[param]` form. */
+const exercised = new Set<string>()
+
+function noteExercised(method: string, route: string) {
+  const pathname = new URL(route, ORIGIN).pathname
+  const matched = matchV2Route(pathname)
+  if (matched) exercised.add(`${method} ${matched.pattern.replace(/\{([^}]+)\}/g, '[$1]')}`)
+}
+
+describe('content reaching Chat is admitted per item', () => {
+  let redis: NonNullable<ReturnType<typeof getRedisClient>>
+  let fixture: ContentFixture
+  let connector: { connectorId: string; documentId: string }
+
+  beforeAll(async () => {
+    fixtureStorage.root = mkdtempSync(path.join(tmpdir(), 'sim-content-delivery-'))
+    const client = getRedisClient()
+    if (!client)
+      throw new Error(
+        'Set TEST_REDIS_URL to a disposable local Redis or use bun run test:integration'
+      )
+    redis = client
+    // Compile the lazy tool graph before request deadlines and per-case provider fixtures exist.
+    await matchV2Route('/api/v2/tools/file_get_content/execute')?.load()
+    fixture = await seedContentFixture()
+    connector = await seedKnowledgeConnector(fixture)
+  }, 120_000)
+
+  afterAll(async () => {
+    if (fixture) await removeContentFixture(fixture)
+    await rm(fixtureStorage.root, { recursive: true, force: true })
+  })
+
+  /** One Chat CLI request through the transport every CLI invocation and engine runs on. */
+  async function cli(method: string, route: string, body?: unknown): Promise<ChatRead> {
+    noteExercised(method, route)
+    const registry = new ResolvedSecretTraceRegistry([], {
+      userId: fixture.ids.aliceId,
+      workspaceId: fixture.ids.workspaceId,
+    })
+    const transport = createAgentCliTransport({
+      endpoint: ORIGIN,
+      invocation: {
+        userId: fixture.ids.aliceId,
+        workspaceId: fixture.ids.workspaceId,
+        chatId: generateId(),
+      },
+      registry,
+      resources: [],
+      observeReads: true,
+    })
+    const response = await withWorkspaceInvocationScope(
+      { workspaceId: fixture.ids.workspaceId, organizationId: fixture.ids.organizationId },
+      () =>
+        transport(`${ORIGIN}${route}`, {
+          method,
+          ...(body === undefined
+            ? {}
+            : { body: JSON.stringify(body), headers: { 'content-type': 'application/json' } }),
+        })
+    )
+    return { status: response.status, body: await bodyText(response), registry }
+  }
+
+  /** One request from run_code's workbench through the private sandbox proxy. */
+  async function sandbox(
+    method: string,
+    route: string,
+    body?: unknown
+  ): Promise<{ status: number; body: string; sessionKey: string }> {
+    noteExercised(method, route)
+    const token = generateId()
+    const apiKey = `sandbox-${generateId()}`
+    const chatId = generateId()
+    await db.insert(copilotChats).values({
+      id: chatId,
+      userId: fixture.ids.aliceId,
+      workspaceId: fixture.ids.workspaceId,
+      type: 'mothership',
+    })
+    await redis.set(
+      `mothership:sandbox-resources:${token}:context`,
+      JSON.stringify({
+        toolCallId: generateId(),
+        runId: generateId(),
+        userId: fixture.ids.aliceId,
+        ownerToken: generateId(),
+        chatId,
+        workspaceId: fixture.ids.workspaceId,
+        apiKeyHash: sha256Hex(apiKey),
+      }),
+      'EX',
+      600
+    )
+    const sessionKey = chatSandboxSessionKey(chatId)
+    /** A freshly created machine starts with clean history, as the sandbox session does. */
+    await initializeSessionFileProvenance(sessionKey, WORKBENCH)
+    const response = await proxySandboxResourceRequest(
+      new Request(`${ORIGIN}/api/mothership/sandbox/${token}${route}`, {
+        method,
+        headers: {
+          'x-api-key': apiKey,
+          ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      }),
+      token
+    )
+    return { status: response.status, body: await bodyText(response), sessionKey }
+  }
+
+  function workbenchHistory(sessionKey: string) {
+    return readSessionSecretProvenance(sessionKey, WORKBENCH)
+  }
+
+  const ws = () => fixture.ids.workspaceId
+  const kbPath = () => `/api/v2/knowledge/${fixture.knowledge.knowledgeBaseId}`
+  const chunksPath = () => `${kbPath()}/documents/${fixture.knowledge.documentId}/chunks`
+  const runPath = () => `/api/v2/workflows/${fixture.run.workflowId}/runs/${fixture.run.runId}`
+
+  /** Asserts the per-item outcome every collection case shares. */
+  function expectPerItem(read: ChatRead, options: { secretAdmitted: boolean }) {
+    expect(read.status).toBe(200)
+    expect(read.body).not.toContain(CANARY.unknown)
+    expect(read.body).toContain(CANARY.clean)
+    expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    const view = modelView(read)
+    expect(view).toBeDefined()
+    expect(view).toContain(CANARY.clean)
+    expect(view).not.toContain(CANARY.secret)
+    if (options.secretAdmitted) expect(read.body).toContain(CANARY.secret)
+    else expect(read.body).not.toContain(CANARY.secret)
+  }
+
+  describe('generic tool route and private provider envelopes', () => {
+    async function providerResponse(options: { complete: boolean; success: boolean }) {
+      const envelope = serializePrivateToolMetadataResponseEnvelope(
+        options.success
+          ? { success: true, data: { content: `provider content ${CANARY.secret}` } }
+          : { success: false, error: `provider refused ${CANARY.secret}` },
+        RESOLVED_SECRET_PROVENANCE_METADATA_V1,
+        {
+          version: 1,
+          complete: options.complete,
+          scope: { userId: fixture.ids.aliceId, workspaceId: ws() },
+          entries: options.complete
+            ? [
+                {
+                  name: 'PROVIDER_TOKEN',
+                  encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+                },
+              ]
+            : [],
+        }
+      )
+      toolProvider.response = Response.json(envelope.body, {
+        status: options.success ? 200 : 400,
+        headers: envelope.headers,
+      })
+    }
+
+    it.each([true, false])(
+      'projects private provider evidence through the CLI tool route (success=%s)',
+      async (success) => {
+        await providerResponse({ complete: true, success })
+        try {
+          const read = await cli('POST', '/api/v2/tools/file_get_content/execute', {
+            workspaceId: ws(),
+            input: { fileId: fixture.files.entries },
+          })
+          expect(read.status).toBe(200)
+          expect(JSON.parse(read.body).data.status).toBe(success ? 'succeeded' : 'failed')
+          expect(modelView(read)).toContain('{{PROVIDER_TOKEN}}')
+          expect(modelView(read)).not.toContain(CANARY.secret)
+          expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+        } finally {
+          toolProvider.response = undefined
+        }
+      }
+    )
+
+    it('withholds an incomplete private provider envelope after the generic tool settles', async () => {
+      await providerResponse({ complete: false, success: true })
+      try {
+        const read = await cli('POST', '/api/v2/tools/file_get_content/execute', {
+          workspaceId: ws(),
+          input: { fileId: fixture.files.unknown },
+        })
+        expect(read.status).not.toBe(200)
+        expect(read.body).not.toContain(CANARY.secret)
+        expect(read.body).toMatch(/settled|completed/)
+        expect(read.body).toMatch(/do not retry/i)
+        expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+      } finally {
+        toolProvider.response = undefined
+      }
+    })
+
+    it('records private provider evidence before sandbox tool response bytes are released', async () => {
+      await providerResponse({ complete: true, success: true })
+      try {
+        const read = await sandbox('POST', '/api/v2/tools/file_get_content/execute', {
+          workspaceId: ws(),
+          input: { fileId: fixture.files.entries },
+        })
+        expect(read.status).toBe(200)
+        expect(read.body).toContain(CANARY.secret)
+        expect(await workbenchHistory(read.sessionKey)).toMatchObject({
+          status: 'exact',
+          entries: [{ name: 'PROVIDER_TOKEN' }],
+        })
+      } finally {
+        toolProvider.response = undefined
+      }
+    })
+  })
+
+  describe('Chat CLI', () => {
+    it('reports omitted files in a partial bulk download (P1/P2, #4)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${Object.values(fixture.files)}`
+      )
+      expectPerItem(read, { secretAdmitted: false })
+      expect(read.body).toContain(CANARY.unrecorded)
+      expect(read.body).toContain('sim-download-report.json')
+      expect(read.body).toContain(fixture.files.unknown)
+      expect(read.body).toContain(fixture.files.entries)
+    })
+
+    it.each([
+      'uncached',
+      'cached',
+      'recovered',
+      'user-error',
+      'subsequent-error',
+      'copied-error',
+      'mutated-refusal',
+    ] as const)('keeps generated-document refusals per item (%s archive)', async (kind) => {
+      const input = fixture.files.unknown
+      const read = `await getFileBase64('${input}');`
+      const code =
+        kind === 'recovered'
+          ? `try { ${read} } catch {} pdf.addPage().drawText('safe fallback');`
+          : kind === 'user-error'
+            ? `const error = new Error('File cannot be sent to a model because its secret provenance is unavailable'); error.name = 'ContentRefusedError'; throw error;`
+            : kind === 'subsequent-error'
+              ? `try { ${read} } catch {} throw new Error('fixture compiler failure');`
+              : kind === 'copied-error'
+                ? `try { ${read} } catch (error) { throw Object.assign(new Error(error.message), error); }`
+                : kind === 'mutated-refusal'
+                  ? `try { ${read} } catch (error) { error.message = 'fixture reworded refusal'; throw error; }`
+                  : `${read} pdf.addPage().drawText('fixture render');`
+      const document = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`const archiveFixture = '${generateId()}'; ${code}`),
+        `archive-refusal-${generateId()}.pdf`,
+        'text/x-python-pdf',
+        { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
+      )
+      if (kind === 'cached') {
+        const warmed = await downloadWorkspaceFileItems.execute({
+          principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
+          input: { workspaceId: ws(), fileIds: [document.id], folderIds: [] },
+        })
+        expect(warmed.renderedDocuments.get(document.id)?.subarray(0, 4).toString()).toBe('%PDF')
+      }
+      const route = `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=`
+      const mixed = await cli('GET', `${route}${fixture.files.clean},${document.id}`)
+      if (kind === 'user-error' || kind === 'subsequent-error' || kind === 'copied-error') {
+        expect(mixed.status).toBe(500)
+        expect(mixed.body).toContain('INTERNAL_ERROR')
+        return
+      }
+      expect(mixed.status, mixed.body).toBe(200)
+      expect(mixed.body).toContain(CANARY.clean)
+      expect(mixed.body).not.toContain(CANARY.unknown)
+      expect(mixed.registry.isPermanentlyIncomplete()).toBe(false)
+      if (kind === 'recovered') {
+        expect(mixed.body).toContain('%PDF')
+        expect(mixed.body).not.toContain('sim-download-report.json')
+      } else {
+        expect(mixed.body).not.toContain('%PDF')
+        expect(mixed.body).toContain('sim-download-report.json')
+        expect(mixed.body).toContain(document.id)
+        const alone = await cli('GET', `${route}${document.id}`)
+        expect(alone.status, alone.body).toBe(403)
+        expect(alone.body).not.toContain(CANARY.unknown)
+      }
+    })
+
+    it('answers files search with locations and withheld unreadable previews (#5, misroute)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
+      )
+      expect(read.status).toBe(200)
+      const results: Array<{ fileId: string; text: string }> = JSON.parse(read.body).data.results
+      const files = new Set(results.map((result) => result.fileId))
+      expect(files.has(fixture.files.clean)).toBe(true)
+      expect(files.has(fixture.files.unrecorded)).toBe(true)
+      expect(files.has(fixture.files.unknown)).toBe(true)
+      expect(results.find((result) => result.fileId === fixture.files.unknown)?.text).toMatch(
+        /preview withheld/i
+      )
+      expect(read.body).not.toContain(CANARY.unknown)
+      expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('refuses an unknown run file and redacts a secret-bearing one (#7)', async () => {
+      const unknown = await cli('GET', `${runPath()}/files/${fixture.run.files.unknown}`)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(false)
+
+      const entries = await cli('GET', `${runPath()}/files/${fixture.run.files.entries}`)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      const clean = await cli('GET', `${runPath()}/files/${fixture.run.files.clean}`)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+    })
+
+    it('inlines only clean run files as base64 (#8)', async () => {
+      const read = await cli('GET', `${runPath()}?includeOutput=true&includeFileBase64=true`)
+      expect(read.status).toBe(200)
+      const files: Array<{ id: string; base64: string | null }> = JSON.parse(read.body).data.files
+      const byId = new Map(files.map((file) => [file.id, file.base64]))
+      expect(byId.get(fixture.run.files.clean)).toBeTruthy()
+      expect(byId.get(fixture.run.files.unknown)).toBeNull()
+      expect(byId.get(fixture.run.files.entries)).toBeNull()
+      expect(read.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('lists only admitted knowledge chunks and refuses an unknown one (#10)', async () => {
+      const list = await cli('GET', `${chunksPath()}?workspaceId=${ws()}`)
+      expectPerItem(list, { secretAdmitted: true })
+
+      const unknown = await cli(
+        'GET',
+        `${chunksPath()}/${fixture.knowledge.chunks.unknown}?workspaceId=${ws()}`
+      )
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('searches knowledge per chunk instead of withholding the whole search (#11, O5)', async () => {
+      const read = await cli('POST', '/api/v2/knowledge/search', {
+        workspaceId: ws(),
+        knowledgeBaseIds: [fixture.knowledge.knowledgeBaseId],
+        query: 'second line',
+      })
+      expectPerItem(read, { secretAdmitted: true })
+    })
+
+    it('exports the allowed knowledge scope without including restricted documents (#12)', async () => {
+      const read = await cli('GET', `${kbPath()}/export?workspaceId=${ws()}`)
+      expect(read.status).toBe(200)
+      expect(read.body).toContain('manifest.json')
+      expect(read.body).not.toContain(CANARY.unknown)
+    })
+
+    it('returns table rows per row instead of withholding the page (#18, O5)', async () => {
+      const read = await cli(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expectPerItem(read, { secretAdmitted: true })
+    })
+
+    it('filters and sorts mixed-provenance rows without refusing unrelated content (#18b)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const predicate = { field: 'note', op: 'contains', value: 'second' }
+      const query = await cli('POST', `${table}/query`, {
+        workspaceId: ws(),
+        predicate,
+        sort: [{ field: 'note', direction: 'asc' }],
+      })
+      expectPerItem(query, { secretAdmitted: true })
+      const count = await cli('POST', `${table}/query/count`, { workspaceId: ws(), predicate })
+      expect(count.status).toBe(200)
+      expect(count.body).not.toContain(CANARY.secret)
+      expect(count.body).not.toContain(CANARY.unknown)
+    })
+
+    it('returns search locations without copying cell values or refusing a mixed table', async () => {
+      const search = await cli('POST', `/api/v2/tables/${fixture.table.tableId}/rows/search`, {
+        workspaceId: ws(),
+        q: 'second',
+      })
+      expect(search.status).toBe(200)
+      const matches: { rowId: string; column: string; ordinal: number }[] = JSON.parse(search.body)
+        .data.matches
+      expect(matches.map((match) => match.rowId).sort()).toEqual(
+        Object.values(fixture.table.rows).sort()
+      )
+      expect(search.body).not.toContain(CANARY.secret)
+      expect(search.body).not.toContain(CANARY.unknown)
+    })
+
+    it.each(['PATCH', 'DELETE'])(
+      'allows a filtered %s beside an unrelated unknown row',
+      async (method) => {
+        const table = `/api/v2/tables/${fixture.table.tableId}`
+        const marker = `temporary-${generateId()}`
+        const created = await cli('POST', `${table}/rows`, {
+          workspaceId: ws(),
+          data: { note: marker },
+        })
+        expect(created.status).toBe(201)
+        const rowId: string = JSON.parse(created.body).data.id
+        const written = await cli(method, `${table}/rows`, {
+          workspaceId: ws(),
+          filter: { field: 'note', op: 'eq', value: marker },
+          ...(method === 'PATCH' ? { data: { note: `${marker}-updated` } } : {}),
+        })
+        expect(written.status).toBe(200)
+        expect(JSON.parse(written.body).data).toMatchObject(
+          method === 'PATCH' ? { updatedCount: 1 } : { deletedCount: 1 }
+        )
+        const read = await cli('GET', `${table}/rows/${rowId}?workspaceId=${ws()}`)
+        expect(read.status).toBe(method === 'PATCH' ? 200 : 404)
+        if (method === 'PATCH') expect(modelView(read)).toContain(`${marker}-updated`)
+      }
+    )
+
+    it('keeps clean matches usable when another row has corrupt provenance', async () => {
+      const created = await cli('POST', '/api/v2/tables', {
+        workspaceId: ws(),
+        name: `clean_${generateId().slice(0, 8)}`,
+        schema: { columns: [{ name: 'note', type: 'string' }] },
+      })
+      expect(created.status).toBe(201)
+      const table = `/api/v2/tables/${JSON.parse(created.body).data.id}`
+      for (const note of ['alpha second', 'beta']) {
+        expect(
+          (await cli('POST', `${table}/rows`, { workspaceId: ws(), data: { note } })).status
+        ).toBe(201)
+      }
+      const guess = { field: 'note', op: 'contains', value: 'second' }
+      const search = await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' })
+      expect(search.status).toBe(200)
+      expect(JSON.parse(search.body).data.matches).toHaveLength(1)
+      const query = await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess })
+      expect(query.status).toBe(200)
+      expect(modelView(query)).toContain('alpha second')
+      const count = await cli('POST', `${table}/query/count`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(count.status).toBe(200)
+
+      /** A sidecar that claims exact but holds no valid entry list vouches for nothing. */
+      const malformed = await cli('POST', `${table}/rows`, {
+        workspaceId: ws(),
+        data: { note: 'gamma' },
+      })
+      await db
+        .update(userTableRowSecretProvenance)
+        .set({ entries: sql`'{"not":"a list"}'::jsonb` })
+        .where(eq(userTableRowSecretProvenance.rowId, JSON.parse(malformed.body).data.id))
+      const afterCorruption = await cli('POST', `${table}/query`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(afterCorruption.status).toBe(200)
+      expect(modelView(afterCorruption)).toContain('alpha second')
+      const refused = await cli(
+        'GET',
+        `${table}/rows/${JSON.parse(malformed.body).data.id}?workspaceId=${ws()}`
+      )
+      expect(refused.status).toBe(403)
+      expect(refused.body).not.toContain('gamma')
+    })
+
+    it.each(['clean', 'entries'] as const)(
+      'applies the archive declared-size budget after %s contributor admission',
+      async (kind) => {
+        const input = await getWorkspaceFile(ws(), fixture.files[kind], { throwOnError: true })
+        if (!input) throw new Error('Missing archive contributor fixture')
+        const source = `await getFileBase64('${input.id}'); pdf.addPage().drawText('fixture render');`
+        const documentIds: string[] = []
+        for (let index = 0; index < (kind === 'clean' ? 6 : 5); index += 1) {
+          const doc = await uploadWorkspaceFile(
+            ws(),
+            fixture.ids.aliceId,
+            Buffer.from(
+              index === 5 ? 'throw new Error("archive budget checked too late")' : source
+            ),
+            `archive-budget-${generateId()}.pdf`,
+            'text/x-python-pdf',
+            {
+              notifyWorkspaceChange: false,
+              secretProvenance: { status: 'exact', entries: [] },
+            }
+          )
+          // Declared source sizes exercise aggregate accounting without large fixture allocations.
+          await db
+            .update(workspaceFiles)
+            .set({ sizeBytes: 50 * 1024 * 1024 })
+            .where(eq(workspaceFiles.id, doc.id))
+          documentIds.push(doc.id)
+        }
+        const result = await cli(
+          'GET',
+          `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${fixture.files.clean},${documentIds}`
+        )
+        if (kind === 'clean') {
+          expect(result.status, result.body).toBe(400)
+          expect(result.body).toMatch(/download limit/i)
+        } else {
+          expect(result.status, result.body).toBe(200)
+          expect(result.body).toContain(CANARY.clean)
+          expect(result.body).toContain('sim-download-report.json')
+          for (const id of documentIds) expect(result.body).toContain(id)
+          expect(result.body).not.toContain('%PDF-1.7')
+        }
+      }
+    )
+
+    it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {
+      const share = (fileId: string) =>
+        cli('PATCH', `/api/v2/files/${fileId}/share`, {
+          workspaceId: ws(),
+          isActive: true,
+          authType: 'public',
+        })
+      expect((await share(fixture.files.unknown)).status).toBe(403)
+      expect((await share(fixture.files.entries)).status).toBe(403)
+      expect((await share(fixture.files.clean)).status).toBe(200)
+    })
+    it.each([
+      'clean',
+      'unrecorded',
+      'secret',
+      'unknown',
+      'old-secret',
+      'malformed',
+      'invalid',
+      'mislabeled',
+      'uploaded',
+      'legacy',
+    ] as const)(
+      'checks the published document inputs before exposing a share (%s)',
+      async (kind) => {
+        const entries = [
+          {
+            name: 'COMPILED_INPUT',
+            encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+            sourceUserId: fixture.ids.aliceId,
+            sourceWorkspaceId: ws(),
+          },
+        ]
+        const inputContent = kind === 'clean' ? CANARY.clean : CANARY.secret
+        const input = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(inputContent),
+          `compiled-input-${generateId()}.txt`,
+          'text/plain',
+          {
+            notifyWorkspaceChange: false,
+            secretProvenance:
+              kind === 'unknown'
+                ? { status: 'unknown' }
+                : kind === 'unrecorded'
+                  ? { status: 'unrecorded' }
+                  : { status: 'exact', entries: kind === 'clean' ? [] : entries },
+          }
+        )
+        const record = await getWorkspaceFile(ws(), input.id, { throwOnError: true })
+        if (!record) throw new Error('Missing compiled input fixture')
+        const source =
+          kind === 'uploaded'
+            ? '%PDF-1.7\nordinary uploaded binary'
+            : `data = open(input_path("${input.id}"), "rb").read()`
+        const document = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(source),
+          `compiled-share-${generateId()}.pdf`,
+          kind === 'mislabeled' || kind === 'uploaded' ? 'application/pdf' : 'text/x-python-pdf',
+          { notifyWorkspaceChange: false, secretProvenance: { status: 'exact', entries: [] } }
+        )
+        const identity = JSON.stringify({
+          version: 1,
+          inputs: [
+            {
+              fileId: input.id,
+              key: record.key,
+              context: record.storageContext ?? 'workspace',
+              contentVersion: (record.contentUpdatedAt ?? record.updatedAt).toISOString(),
+              size: record.size,
+            },
+          ],
+        })
+        const artifact = Buffer.from(`%PDF-1.7\n${inputContent}`)
+        await storeCompiledDoc(
+          ws(),
+          source,
+          'pdf',
+          'application/pdf',
+          artifact,
+          kind === 'legacy'
+            ? undefined
+            : kind === 'malformed'
+              ? '{invalid'
+              : kind === 'invalid'
+                ? JSON.stringify({ version: 1, inputs: [{}] })
+                : identity
+        )
+        const published = await resolveServableDoc(ws(), Buffer.from(source), document.name)
+        expect(published.kind).toBe(kind === 'uploaded' ? 'passthrough' : 'artifact')
+        if (published.kind === 'artifact') expect(published.buffer).toEqual(artifact)
+        if (kind === 'old-secret') {
+          await replaceFixtureFileContent(
+            ws(),
+            input.id,
+            fixture.ids.aliceId,
+            Buffer.from('now clean'),
+            undefined,
+            {
+              version: { source: 'api', authorUserId: fixture.ids.aliceId },
+              secretProvenancePolicy: {
+                mode: 'replace',
+                provenance: { status: 'exact', entries: [] },
+              },
+            }
+          )
+        }
+        const allowed = ['clean', 'unrecorded', 'legacy', 'uploaded'].includes(kind)
+        const invalid = kind === 'malformed' || kind === 'invalid'
+        const activation = await cli('PATCH', `/api/v2/files/${document.id}/share`, {
+          workspaceId: ws(),
+          isActive: true,
+          authType: 'public',
+        })
+        expect.soft(activation.status).toBe(allowed ? 200 : invalid ? 500 : 403)
+        if (!allowed) expect.soft(await getShareForResource('file', document.id)).toBeNull()
+
+        const humanShare = await updateWorkspaceFileShare.execute({
+          principal: createSessionPrincipal({ userId: fixture.ids.aliceId }),
+          input: { fileId: document.id, isActive: true, authType: 'public' },
+        })
+        expect(humanShare.share.isActive).toBe(true)
+        for (const read of [cli, sandbox]) {
+          const link = await read('GET', `/api/v2/files/${document.id}/share?workspaceId=${ws()}`)
+          expect.soft(link.status).toBe(allowed ? 200 : invalid ? 500 : 403)
+          if (!allowed) expect.soft(link.body).not.toContain(humanShare.share.token)
+        }
+        if (!invalid) {
+          const result = await observeContentDelivery(
+            createRegistryContentGate({
+              registry: new ResolvedSecretTraceRegistry([]),
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            () =>
+              getWorkspaceFileShares.execute({
+                principal: createCopilotChatPrincipal(
+                  { userId: fixture.ids.aliceId, workspaceId: ws() },
+                  WORKSPACE_FILES_DELEGATION_AUDIENCE
+                ),
+                input: { workspaceId: ws(), fileIds: [document.id, fixture.files.clean] },
+              })
+          )
+          expect(result.shares.has(document.id)).toBe(allowed)
+          expect(result.shares.has(fixture.files.clean)).toBe(true)
+        }
+      }
+    )
+
+    it('reads one file directly: clean as is, secrets redacted, unknown withheld whole (#1, D7)', async () => {
+      const download = (fileId: string) => cli('GET', `/api/v2/files/${fileId}?workspaceId=${ws()}`)
+      const clean = await download(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const entries = await download(fixture.files.entries)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).toBeDefined()
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      /** The single-file exception: delivered for the workbench, never shown to the model. */
+      const unknown = await download(fixture.files.unknown)
+      expect(unknown.status).toBe(200)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(true)
+      expect(modelView(unknown)).toBeUndefined()
+    })
+
+    it('reads file text per file and refuses unknown text (#2)', async () => {
+      const text = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/text?workspaceId=${ws()}`)
+      const clean = await text(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const entries = await text(fixture.files.entries)
+      expect(entries.status).toBe(200)
+      expect(modelView(entries)).not.toContain(CANARY.secret)
+
+      const unknown = await text(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+      expect(unknown.registry.isPermanentlyIncomplete()).toBe(false)
+    })
+
+    it('reads a historical version as text under its own classification (#3)', async () => {
+      const version = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/versions/1/text?workspaceId=${ws()}`)
+      const clean = await version(fixture.files.clean)
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const unknown = await version(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('refuses an edit whose search would probe unknown text, and edits a clean file (#22)', async () => {
+      const edit = (fileId: string) =>
+        cli('PATCH', `/api/v2/files/${fileId}/content`, {
+          workspaceId: ws(),
+          edit: { mode: 'search_replace', search: 'tainted', content: 'probed' },
+        })
+      const unknown = await edit(fixture.files.unknown)
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+
+      const scratch = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from('scratch notes tainted once'),
+        `scratch-${generateId()}.txt`,
+        'text/plain',
+        { secretProvenance: { status: 'exact', entries: [] }, notifyWorkspaceChange: false }
+      )
+      expect((await edit(scratch.id)).status).toBe(200)
+    })
+
+    it('replaces a file’s content without reading what it held (#22)', async () => {
+      const scratch = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`replaced ${CANARY.unknown}`),
+        `replace-${generateId()}.txt`,
+        'text/plain',
+        { secretProvenance: { status: 'unknown' }, notifyWorkspaceChange: false }
+      )
+      const write = await cli('PUT', `/api/v2/files/${scratch.id}/content`, {
+        workspaceId: ws(),
+        content: 'fresh content',
+      })
+      expect(write.status).toBe(200)
+      expect(write.body).not.toContain(CANARY.unknown)
+    })
+
+    it('reads a share’s state only for a file Chat could share (#9)', async () => {
+      const read = (fileId: string) =>
+        cli('GET', `/api/v2/files/${fileId}/share?workspaceId=${ws()}`)
+      expect((await read(fixture.files.clean)).status).toBe(200)
+      const unknown = await read(fixture.files.unknown)
+      /** An unshared file's share state names no content, so it reads like any other. */
+      expect(unknown.status).toBe(200)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+    })
+
+    it('lists, reads and updates knowledge documents by their own metadata (#13)', async () => {
+      const list = await cli('GET', `${kbPath()}/documents?workspaceId=${ws()}`)
+      expect(list.status).toBe(200)
+      expect(list.body).toContain(fixture.knowledge.documentId)
+
+      const synced = await cli(
+        'GET',
+        `${kbPath()}/connectors/${connector.connectorId}/documents?workspaceId=${ws()}`
+      )
+      expect(synced.status).toBe(200)
+      expect(synced.body).toContain(connector.documentId)
+
+      const read = await cli(
+        'GET',
+        `${kbPath()}/documents/${fixture.knowledge.documentId}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(200)
+      expect(read.body).not.toContain(CANARY.unknown)
+
+      const update = await cli('PATCH', `${kbPath()}/documents/${fixture.knowledge.documentId}`, {
+        workspaceId: ws(),
+        enabled: true,
+      })
+      expect(update.status).toBe(200)
+      expect(update.body).not.toContain(CANARY.unknown)
+
+      const usage = await cli('GET', `${kbPath()}/tags/usage?workspaceId=${ws()}`)
+      expect(usage.status).toBe(200)
+      expect(usage.body).not.toContain(CANARY.unknown)
+    })
+
+    it('creates and updates chunks without echoing unknown content (#10)', async () => {
+      const created = await cli('POST', chunksPath(), {
+        workspaceId: ws(),
+        content: 'chat wrote this chunk',
+      })
+      expect(created.status).toBe(201)
+      expect(modelView(created)).toContain('chat wrote this chunk')
+
+      const updated = await cli('PATCH', `${chunksPath()}/${fixture.knowledge.chunks.unknown}`, {
+        workspaceId: ws(),
+        enabled: true,
+      })
+      /** The toggle commits and is audited; the chunk it would echo stays unknown, so is refused. */
+      expect(updated.status).toBe(403)
+      expect(updated.body).not.toContain(CANARY.unknown)
+    })
+
+    it('queries, counts and reads table rows per row (#18)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const query = await cli('POST', `${table}/query`, { workspaceId: ws() })
+      expectPerItem(query, { secretAdmitted: true })
+
+      const count = await cli('POST', `${table}/query/count`, { workspaceId: ws() })
+      expect(count.status).toBe(200)
+
+      const clean = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.clean}?workspaceId=${ws()}`
+      )
+      expect(clean.status).toBe(200)
+      expect(modelView(clean)).toContain(CANARY.clean)
+
+      const unknown = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.unknown}?workspaceId=${ws()}`
+      )
+      expect(unknown.status).toBe(403)
+      expect(unknown.body).not.toContain(CANARY.unknown)
+
+      const enrichment = await cli(
+        'GET',
+        `${table}/rows/${fixture.table.rows.unknown}/enrichment/${generateId()}?workspaceId=${ws()}`
+      )
+      expect(enrichment.status).toBe(404)
+      expect(enrichment.body).not.toContain(CANARY.unknown)
+    })
+
+    it('writes rows and returns only what a write may show (#18)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const created = await cli('POST', `${table}/rows`, {
+        workspaceId: ws(),
+        data: { note: 'chat row' },
+      })
+      expect(created.status).toBe(201)
+      expect(modelView(created)).toContain('chat row')
+
+      const updated = await cli('PATCH', `${table}/rows/${fixture.table.rows.unknown}`, {
+        workspaceId: ws(),
+        data: { note: 'overwritten by chat' },
+      })
+      /** A row once unknown stays unknown after a partial write, so the echo is refused. */
+      expect(updated.status).toBe(403)
+      expect(updated.body).not.toContain(CANARY.unknown)
+
+      const keyed = await cli('POST', '/api/v2/tables', {
+        workspaceId: ws(),
+        name: `keyed_${generateId().slice(0, 8)}`,
+        schema: { columns: [{ name: 'key', type: 'string', unique: true }] },
+      })
+      expect(keyed.status).toBe(201)
+      const keyedId: string = JSON.parse(keyed.body).data.id
+      const upsert = () =>
+        cli('POST', `/api/v2/tables/${keyedId}/rows/upsert`, {
+          workspaceId: ws(),
+          data: { key: 'chat-upserted' },
+        })
+      for (const write of [await upsert(), await upsert()]) {
+        expect(write.status).toBe(200)
+        expect(modelView(write)).toContain('chat-upserted')
+      }
+    })
+  })
+
+  it.each(['test', 'changelog'] as const)(
+    'reads an owned %s body using its canonical provenance identity',
+    async (context) => {
+      featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(true)
+      const content = 'owned file source for an authorized read'
+      const ownerId = generateId()
+      const created = await createOwnedWorkspaceFile({
+        context,
+        workspaceId: ws(),
+        userId: fixture.ids.aliceId,
+        content,
+        contentType: 'text/plain',
+        fileName: (fileId) => `${fileId}.txt`,
+        insertOwner: async (tx, bodyFileId) => {
+          if (context === 'test') {
+            await tx.insert(workflowTest).values({
+              id: ownerId,
+              workspaceId: ws(),
+              name: ownerId,
+              title: 'Owned test fixture',
+              bodyFileId,
+              sourceHash: sha256Hex(content),
+            })
+          } else {
+            await tx.insert(changelogRelease).values({
+              id: ownerId,
+              workspaceId: ws(),
+              title: 'Owned release fixture',
+              versionMajor: 1,
+              versionMinor: 0,
+              versionPatch: 0,
+              bumpReason: 'fixture',
+              bodyFileId,
+            })
+          }
+        },
+      })
+      const principal = createCopilotChatPrincipal(
+        { userId: fixture.ids.aliceId, workspaceId: ws() },
+        WORKSPACE_FILES_DELEGATION_AUDIENCE
+      )
+      const registry = new ResolvedSecretTraceRegistry([], {
+        userId: fixture.ids.aliceId,
+        workspaceId: ws(),
+      })
+      const result = await observeContentDelivery(
+        createRegistryContentGate({
+          registry,
+          actorUserId: fixture.ids.aliceId,
+          workspaceId: ws(),
+        }),
+        () =>
+          readWorkspaceFileContent.execute({
+            principal,
+            input: { fileId: created.fileId, includeSecretProvenance: true },
+          })
+      )
+      expect(result.content.toString()).toBe(content)
+      expect(result.file.vfsNamespace).toBe(context === 'test' ? 'tests' : 'changelog')
+      expect(result.secretProvenance).toEqual({ status: 'exact', entries: [] })
+      featureFlagsMockFns.mockIsFeatureEnabled.mockReset()
+    }
+  )
+
+  describe.each([
+    ['image', generateImageServerTool],
+    ['audio', generateAudioServerTool],
+    ['video', generateVideoServerTool],
+  ] as const)('%s reference delivery', (_kind, tool) => {
+    it.each(['clean', 'unrecorded', 'entries', 'unknown', 'changed'] as const)(
+      'classifies the bytes actually read for a %s reference before provider delivery',
+      async (classification) => {
+        mediaProvider.calls.length = 0
+        const exact: WorkspaceFileSecretProvenance = {
+          status: 'exact',
+          entries: [
+            {
+              encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+              sourceUserId: fixture.ids.aliceId,
+              sourceWorkspaceId: ws(),
+              name: 'MEDIA_REFERENCE_TOKEN',
+            },
+          ],
+        }
+        const provenance: WorkspaceFileSecretProvenance =
+          classification === 'entries'
+            ? exact
+            : classification === 'unknown'
+              ? { status: 'unknown' }
+              : classification === 'unrecorded'
+                ? { status: 'unrecorded' }
+                : { status: 'exact', entries: [] }
+        const bytes = Buffer.from(
+          classification === 'entries' ? CANARY.secret : 'ordinary reference bytes'
+        )
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          bytes,
+          `media-reference-${generateId()}.png`,
+          'image/png',
+          { secretProvenance: provenance, notifyWorkspaceChange: false }
+        )
+        const originalRead = readWorkspaceFileContent.execute.bind(readWorkspaceFileContent)
+        const interleave =
+          classification === 'changed'
+            ? vi.spyOn(readWorkspaceFileContent, 'execute').mockImplementationOnce(async (args) => {
+                await replaceFixtureFileContent(
+                  ws(),
+                  file.id,
+                  fixture.ids.aliceId,
+                  Buffer.from(CANARY.secret),
+                  undefined,
+                  {
+                    version: { source: 'api', authorUserId: fixture.ids.aliceId },
+                    secretProvenancePolicy: { mode: 'replace', provenance: exact },
+                  }
+                )
+                return originalRead(args)
+              })
+            : undefined
+        const registry = new ResolvedSecretTraceRegistry([], {
+          userId: fixture.ids.aliceId,
+          workspaceId: ws(),
+        })
+        try {
+          const result = await observeContentDelivery(
+            createRegistryContentGate({
+              registry,
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            () =>
+              tool.execute(
+                {
+                  prompt: 'ordinary request',
+                  inputs: { files: [{ path: `files/${file.name}` }] },
+                },
+                {
+                  userId: fixture.ids.aliceId,
+                  workspaceId: ws(),
+                  toolCallId: generateId(),
+                  copilotToolExecution: true,
+                  resolvedSecretTraceRegistry: registry,
+                }
+              )
+          )
+          const allowed = classification === 'clean' || classification === 'unrecorded'
+          expect(result.success).toBe(false)
+          expect(result.message).toContain(
+            allowed ? 'fixture media provider reached' : 'cannot be sent'
+          )
+          expect(mediaProvider.calls).toHaveLength(allowed ? 1 : 0)
+          if (allowed)
+            expect(JSON.stringify(mediaProvider.calls)).toContain(bytes.toString('base64'))
+          expect(registry.isPermanentlyIncomplete()).toBe(false)
+        } finally {
+          interleave?.mockRestore()
+        }
+      }
+    )
+  })
+
+  describe.each(['cli', 'sandbox'] as const)('%s text excerpts', (surface) => {
+    const read = (route: string) => (surface === 'cli' ? cli('GET', route) : sandbox('GET', route))
+
+    it('preserves indexed match locations without releasing a clipped secret prefix', async () => {
+      const query = `preview-cut-${generateId()}`
+      const provenance: WorkspaceFileSecretProvenance = {
+        status: 'exact',
+        entries: [
+          {
+            encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+            sourceUserId: fixture.ids.aliceId,
+            sourceWorkspaceId: ws(),
+            name: 'FIXTURE_TOKEN',
+          },
+        ],
+      }
+      const sources = [
+        {
+          name: 'protected',
+          content: `${`${query} `.padEnd(500, '.')}${CANARY.secret} after the token`,
+          provenance,
+        },
+        {
+          name: 'clean',
+          content: `${query} clean preview`,
+          provenance: { status: 'exact', entries: [] } as const,
+        },
+        {
+          name: 'unrecorded',
+          content: `${query} ordinary uploaded preview`,
+          provenance: { status: 'unrecorded' } as const,
+        },
+      ]
+      const fileIds: string[] = []
+      for (const source of sources) {
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(source.content),
+          `${source.name}-${generateId()}.txt`,
+          'text/plain',
+          { secretProvenance: source.provenance, notifyWorkspaceChange: false }
+        )
+        fileIds.push(file.id)
+        const sourceContentUpdatedAt = file.contentUpdatedAt ?? new Date()
+        const dispatchedAt = new Date()
+        await db
+          .insert(workspaceFileSearchRevision)
+          .values({
+            fileId: file.id,
+            workspaceId: ws(),
+            sourceContentUpdatedAt,
+            status: 'pending',
+            dispatchedAt,
+          })
+          .onConflictDoUpdate({
+            target: workspaceFileSearchRevision.fileId,
+            set: { status: 'pending', dispatchedAt, sourceContentUpdatedAt, buildId: null },
+          })
+        await indexWorkspaceFileForSearch(
+          {
+            workspaceId: ws(),
+            fileId: file.id,
+            sourceContentUpdatedAt: sourceContentUpdatedAt.toISOString(),
+            dispatchToken: dispatchedAt.toISOString(),
+          },
+          new AbortController().signal
+        )
+      }
+      const route = `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent(query)}&maxResults=3`
+      const userRead = await callV2(fixture, 'GET', route)
+      expect(userRead.status).toBe(200)
+      const userResults: Array<{ fileId: string; text: string }> = (await userRead.json()).data
+        .results
+      const protectedPreview = userResults.find((result) => result.fileId === fileIds[0])?.text
+      expect(protectedPreview).toContain(CANARY.secret.slice(0, 12))
+      expect(protectedPreview).not.toContain(CANARY.secret)
+
+      const result = await read(route)
+      expect(result.status).toBe(200)
+      const data: {
+        results: Array<{ fileId: string; lineNumber: number; text: string }>
+        count: number
+        truncated: boolean
+      } = JSON.parse(result.body).data
+      expect(data.count).toBe(3)
+      expect(data.truncated).toBe(false)
+      expect(new Set(data.results.map((entry) => entry.fileId))).toEqual(new Set(fileIds))
+      expect(data.results.find((entry) => entry.fileId === fileIds[0])).toMatchObject({
+        lineNumber: 1,
+        text: expect.stringMatching(/preview withheld/i),
+      })
+      expect(data.results.find((entry) => entry.fileId === fileIds[1])?.text).toBe(
+        sources[1].content
+      )
+      expect(data.results.find((entry) => entry.fileId === fileIds[2])?.text).toBe(
+        sources[2].content
+      )
+      expect(result.body).not.toContain(CANARY.secret.slice(0, 12))
+    })
+
+    it('keeps a one-line read within the file owner’s extraction budget', async () => {
+      const file = await uploadWorkspaceFile(
+        ws(),
+        fixture.ids.aliceId,
+        Buffer.from(`small selected line\n${CANARY.secret}\n${'.'.repeat(17 * 1024 * 1024)}`),
+        `large-line-window-${generateId()}.txt`,
+        'text/plain',
+        {
+          secretProvenance: {
+            status: 'exact',
+            entries: [
+              {
+                encryptedValue: (await encryptSecret(CANARY.secret)).encrypted,
+                sourceUserId: fixture.ids.aliceId,
+                sourceWorkspaceId: ws(),
+                name: 'FIXTURE_TOKEN',
+              },
+            ],
+          },
+          notifyWorkspaceChange: false,
+        }
+      )
+      const result = await read(
+        `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=1&limit=1`
+      )
+      expect(result.status).toBe(200)
+      expect(JSON.parse(result.body).data.text).toBe('small selected line')
+      expect(result.body).not.toContain(CANARY.secret)
+    })
+
+    it.each(['\n', '\r\n'])(
+      'preserves original line positions while redacting a multiline secret (%j)',
+      async (eol) => {
+        const secret = `RANGE_TOKEN_FIRST_LINE_64C1${eol}RANGE_TOKEN_SECOND_LINE_97B2`
+        const file = await uploadWorkspaceFile(
+          ws(),
+          fixture.ids.aliceId,
+          Buffer.from(`header${eol}${secret}${eol}footer`),
+          `line-window-${generateId()}.txt`,
+          'text/plain',
+          {
+            secretProvenance: {
+              status: 'exact',
+              entries: [
+                {
+                  encryptedValue: (await encryptSecret(secret)).encrypted,
+                  sourceUserId: fixture.ids.aliceId,
+                  sourceWorkspaceId: ws(),
+                  name: 'RANGE_TOKEN',
+                },
+              ],
+            },
+            notifyWorkspaceChange: false,
+          }
+        )
+        const result = await read(
+          `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=2&limit=1`
+        )
+        expect(result.status).toBe(200)
+        expect(JSON.parse(result.body).data.text).toBe('{{RANGE_TOKEN}}')
+        expect(JSON.parse(result.body).data.lineRange).toEqual({
+          offset: 2,
+          lineCount: 1,
+          totalLines: 4,
+          totalLinesExact: true,
+        })
+        for (const [offset, expected] of [
+          [3, '{{RANGE_TOKEN}}'],
+          [4, 'footer'],
+        ] as const) {
+          const selected = await read(
+            `/api/v2/files/${file.id}/text?workspaceId=${ws()}&offset=${offset}&limit=1`
+          )
+          expect(selected.status).toBe(200)
+          expect(JSON.parse(selected.body).data).toMatchObject({
+            text: expected,
+            lineRange: { offset, lineCount: 1, totalLines: 4, totalLinesExact: true },
+          })
+        }
+        if (surface === 'cli') {
+          const registry = new ResolvedSecretTraceRegistry([], {
+            userId: fixture.ids.aliceId,
+            workspaceId: ws(),
+          })
+          const privateRead = await observeContentDelivery(
+            createRegistryContentGate({
+              registry,
+              actorUserId: fixture.ids.aliceId,
+              workspaceId: ws(),
+            }),
+            async () => {
+              const original = await readWorkspaceFileContent.execute({
+                principal: createCopilotChatPrincipal(
+                  { userId: fixture.ids.aliceId, workspaceId: ws() },
+                  WORKSPACE_FILES_DELEGATION_AUDIENCE
+                ),
+                input: { fileId: file.id },
+              })
+              return observePrivateFile(
+                {
+                  buffer: original.content,
+                  name: original.file.name,
+                  path: original.file.path,
+                  source: 'upload',
+                },
+                {},
+                { offset: 3, limit: 2 }
+              )
+            }
+          )
+          expect(privateRead.exitCode).toBe(0)
+          expect(JSON.parse(privateRead.stdout)).toMatchObject({
+            text: `{{RANGE_TOKEN}}${eol}footer`,
+            lineRange: { offset: 3, lineCount: 2, totalLines: 4, totalLinesExact: true },
+          })
+        }
+        expect(result.body).not.toContain('RANGE_TOKEN_FIRST_LINE_64C1')
+        expect(result.body).not.toContain('RANGE_TOKEN_SECOND_LINE_97B2')
+        if ('sessionKey' in result) {
+          expect(await workbenchHistory(result.sessionKey)).toMatchObject({
+            status: 'exact',
+            entries: [expect.objectContaining({ name: 'RANGE_TOKEN' })],
+          })
+        }
+      }
+    )
+  })
+
+  describe('run_code sandbox proxy', () => {
+    it('refuses an unknown file read without tainting the workbench (O1)', async () => {
+      const read = await sandbox(
+        'GET',
+        `/api/v2/files/${fixture.files.unknown}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(403)
+      expect(read.body).not.toContain(CANARY.unknown)
+      expect(await workbenchHistory(read.sessionKey)).toEqual({ status: 'exact', entries: [] })
+    })
+
+    it('records the entries of a secret-bearing read in the workbench history', async () => {
+      const read = await sandbox(
+        'GET',
+        `/api/v2/files/${fixture.files.entries}?workspaceId=${ws()}`
+      )
+      expect(read.status).toBe(200)
+      const history = await workbenchHistory(read.sessionKey)
+      expect(history.status).toBe('exact')
+      expect(history.status === 'exact' && history.entries.length).toBe(1)
+    })
+
+    it('zips and searches only admitted files (P1)', async () => {
+      const zip = await sandbox(
+        'GET',
+        `/api/v2/files/bulk-download?workspaceId=${ws()}&fileIds=${Object.values(fixture.files)}`
+      )
+      expect(zip.status).toBe(200)
+      expect(zip.body).toContain(CANARY.clean)
+      expect(zip.body).toContain(CANARY.secret)
+      expect(await workbenchHistory(zip.sessionKey)).toMatchObject({
+        status: 'exact',
+        entries: [expect.objectContaining({ name: 'FIXTURE_TOKEN' })],
+      })
+      expect(zip.body).not.toContain(CANARY.unknown)
+      expect(zip.body).toContain('sim-download-report.json')
+      expect(zip.body).toContain(fixture.files.unknown)
+
+      const search = await sandbox(
+        'GET',
+        `/api/v2/files/search?workspaceId=${ws()}&query=${encodeURIComponent('PROVENANCE')}`
+      )
+      expect(search.status).toBe(200)
+      expect(search.body).toContain(fixture.files.unknown)
+      expect(search.body).toMatch(/preview withheld/i)
+      expect(search.body).not.toContain(CANARY.unknown)
+      expect((await workbenchHistory(search.sessionKey)).status).toBe('exact')
+    })
+
+    it('refuses table export download links and unknown run files (#17, #7)', async () => {
+      const exportLink = await sandbox(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/exports/${generateId()}/download?workspaceId=${ws()}`
+      )
+      expect(exportLink.status).toBe(403)
+
+      const runFile = await sandbox('GET', `${runPath()}/files/${fixture.run.files.unknown}`)
+      expect(runFile.status).toBe(403)
+      expect(runFile.body).not.toContain(CANARY.unknown)
+    })
+
+    it('completes a write whose result cannot be recorded, then withholds it (502)', async () => {
+      const note = `committed ${generateId()}`
+      workbench.available = false
+      let write: Awaited<ReturnType<typeof sandbox>>
+      try {
+        write = await sandbox('POST', `/api/v2/tables/${fixture.table.tableId}/rows`, {
+          workspaceId: ws(),
+          data: { note },
+        })
+      } finally {
+        workbench.available = true
+      }
+      expect(write.status).toBe(502)
+      expect(write.body).not.toContain(note)
+      expect(write.body).toContain('The change was saved')
+      expect(write.body).toContain('Do not retry the change')
+      const rows = await cli(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expect(rows.body).toContain(note)
+    })
+
+    it('excludes unknown knowledge chunks and table rows (#10, #18)', async () => {
+      const chunks = await sandbox('GET', `${chunksPath()}?workspaceId=${ws()}`)
+      expect(chunks.status).toBe(200)
+      expect(chunks.body).toContain(CANARY.clean)
+      expect(chunks.body).not.toContain(CANARY.unknown)
+
+      const rows = await sandbox(
+        'GET',
+        `/api/v2/tables/${fixture.table.tableId}/rows?workspaceId=${ws()}`
+      )
+      expect(rows.status).toBe(200)
+      expect(rows.body).toContain(CANARY.clean)
+      expect(rows.body).not.toContain(CANARY.unknown)
+      expect((await workbenchHistory(rows.sessionKey)).status).toBe('exact')
+    })
+  })
+
+  it('drives every content route Chat may call, or names the test that proves it', () => {
+    const missing = contentRoutes
+      .map((route) => `${route.method} ${route.path}`)
+      .filter((key) => !exercised.has(key) && !PROVEN_ELSEWHERE[key])
+    expect(missing).toEqual([])
+  })
+})
diff --git a/apps/sim/lib/mothership/agent-cli/engines/file-read.ts b/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
index da8cf096a34..3357e3d8d00 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/file-read.ts
@@ -54,16 +54,17 @@ export const fileReadCommand: AgentCliEngine = {
         if (!match) return agentCliFail('Use knowledge/<knowledgeBaseId>/<documentId>.')
         const principal = enginePrincipal(runtime, readOriginalKnowledgeDocument)
         if (!principal) return agentCliFail('Knowledge authentication is unavailable.')
-        const { buffer, ...metadata } = await readOriginalKnowledgeDocument.execute({
-          principal,
-          input: {
-            knowledgeBaseId: match[1],
-            documentId: match[2],
-            assertedWorkspaceId: runtime.workspaceId,
-            maxBytes: query.data.maxBytes,
-            signal: runtime.signal,
-          },
-        })
+        const { buffer, hasRecordedSecrets, ...metadata } =
+          await readOriginalKnowledgeDocument.execute({
+            principal,
+            input: {
+              knowledgeBaseId: match[1],
+              documentId: match[2],
+              assertedWorkspaceId: runtime.workspaceId,
+              maxBytes: query.data.maxBytes,
+              signal: runtime.signal,
+            },
+          })
         if (!buffer)
           return agentCliOk(
             JSON.stringify({
@@ -74,7 +75,14 @@ export const fileReadCommand: AgentCliEngine = {
             })
           )
         return await observePrivateFile(
-          { buffer, ...metadata, knowledge: metadata, path: reference, source: 'knowledge' },
+          {
+            buffer,
+            ...metadata,
+            knowledge: metadata,
+            path: reference,
+            source: 'knowledge',
+            hasRecordedSecrets,
+          },
           flags,
           query.data,
           runtime.signal
diff --git a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
index f6ccc0bb5e6..1c88f7a57c4 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/observe-private-file.ts
@@ -1,3 +1,4 @@
+import { ContentRefusedError, redactBeforeCutting } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { AgentCliFlags } from '@/lib/mothership/agent-cli/types'
 import { agentCliOk } from '@/lib/mothership/agent-cli/types'
@@ -15,6 +16,8 @@ export async function observePrivateFile(
     path: string
     source: 'sandbox' | 'upload' | 'knowledge'
     contentType?: string
+    /** The bytes hold secrets whose text redaction a rendered image would bypass. */
+    hasRecordedSecrets?: boolean
     knowledge?: {
       documentId: string
       knowledgeBaseId: string
@@ -38,6 +41,9 @@ export async function observePrivateFile(
   const textRange = options.offset !== undefined || options.limit !== undefined
   const visual = flags.render !== undefined || flags.pages !== undefined
   if (visual || (!textRange && (type.startsWith('image/') || type === 'application/pdf'))) {
+    if (file.hasRecordedSecrets) {
+      throw new ContentRefusedError('workspace-file')
+    }
     const decoded = await decodeFileVisual({
       buffer: file.buffer,
       name: file.name,
@@ -71,8 +77,15 @@ export async function observePrivateFile(
   if (format) {
     const parsed = await parseFileText(file.buffer, format, file.name)
     const truncated = parsed.metadata?.truncated === true
+    const ranged = options.offset !== undefined || options.limit !== undefined
     const { text, lineRange } = sliceFileTextLines(
-      parsed.content,
+      ranged
+        ? await redactBeforeCutting(
+            undefined,
+            parsed.content,
+            file.source === 'knowledge' ? 'knowledge-document' : 'workspace-file'
+          )
+        : parsed.content,
       options.offset,
       options.limit,
       truncated
diff --git a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
index d4496a4f677..088964a2d1e 100644
--- a/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
+++ b/apps/sim/lib/mothership/agent-cli/engines/universal-grep.ts
@@ -1,6 +1,6 @@
 import { sleep } from '@sim/utils/helpers'
 import { isRecordLike } from '@sim/utils/object'
-import { truncate } from '@sim/utils/string'
+import { escapeRegExp } from '@sim/utils/string'
 import type { ReadFileTextResponse } from 'sim/embed'
 import { listCatalogTools } from '@/lib/catalog/application/list-tools'
 import { readBlockCatalog } from '@/lib/catalog/application/read-block-catalog'
@@ -14,6 +14,9 @@ import {
   agentCliOk,
 } from '@/lib/mothership/agent-cli/types'
 import { buildIntegrationToolSchemas } from '@/lib/mothership/chat/payload'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { OPAQUE_RESOLVED_SECRET_REPLACEMENT } from '@/executor/utils/resolved-secret-matcher'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * `grep <pattern> [--scope a,b] [--in <world|id|name|world/id>] [-i] [-C n] [-A n] [-B n] [--count] [--limit n]` —
@@ -430,8 +433,38 @@ function compilePattern(raw: string, ignoreCase: boolean): (line: string) => boo
   return (line) => (ignoreCase ? line.toLowerCase() : line).includes(needle)
 }
 
+/** What redaction leaves in place of a secret: a `{{NAME}}` label or the opaque marker. */
+const REDACTION_MARKER = new RegExp(
+  `\\{\\{[^{}]+\\}\\}|${escapeRegExp(OPAQUE_RESOLVED_SECRET_REPLACEMENT)}`,
+  'g'
+)
+
+/** Clips redacted text, cutting before a redaction marker rather than through it. */
 function clip(line: string): string {
-  return truncate(line, MAX_LINE_CHARS, '… [line truncated]')
+  if (line.length <= MAX_LINE_CHARS) return line
+  let cut = MAX_LINE_CHARS
+  for (const marker of line.matchAll(REDACTION_MARKER)) {
+    if (marker.index >= cut) break
+    if (marker.index + marker[0].length > cut) {
+      cut = marker.index
+      break
+    }
+  }
+  return `${line.slice(0, cut)}… [line truncated]`
+}
+
+/**
+ * Model egress redacts whole secrets only, so a line clipped, or a multi-line secret split into
+ * lines, would carry a fragment it cannot recognize. The text is redacted whole first, through the
+ * same provenance egress uses; null means it could not be, and the resource is not searched.
+ * Without a registry egress withholds the whole result, so there is nothing to redact against.
+ */
+function redactForModel(text: string, egress: ResolvedSecretTraceRegistry | undefined) {
+  if (!egress) return text
+  const projection = projectResolvedSecretModelContent(text, egress, undefined, {
+    preserveLineBreaks: true,
+  })
+  return projection.safe && typeof projection.value === 'string' ? projection.value : null
 }
 
 function didYouMean(scope: string): string {
@@ -587,9 +620,17 @@ export const universalGrepCommand: AgentCliEngine = {
       }
       return now
     }
+    const egress = runtime.resolvedSecretTraceRegistry?.forkForPropagatedEntries()
     for (const resource of candidates) {
       if (resource.text === null) continue
-      const lines = resource.text.split('\n')
+      const text = redactForModel(resource.text, egress)
+      if (text === null) {
+        bounded.reportIncomplete(
+          `${resource.scope}/${resource.label} (${resource.id}): could not be checked for secret values, so it was not searched.`
+        )
+        continue
+      }
+      const lines = text.split('\n')
       const selected = new Map<number, boolean>()
       const remainingLines = limit - out.length
       let nextContextLine = 0
diff --git a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
index 893d05af5e5..ea3e9c6b0c7 100644
--- a/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-provenance.test.ts
@@ -43,6 +43,12 @@ vi.mock('@/lib/execution/remote-sandbox/session-file-snapshot', () => ({
 }))
 vi.mock('@/lib/mothership/chat/delegation', () => ({ mintDelegationToken: async () => 'fixture' }))
 
+import {
+  admitContent,
+  type ContentSource,
+  noteContentDeliveryOperation,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
@@ -52,9 +58,13 @@ vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
 }))
 
 import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
-import { reportWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { readWorkspaceFileArtifact } from '@/lib/workspace-files/application/read-workspace-file-artifact'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -83,6 +93,14 @@ mothershipWorkspaceTargetMockFns.mockResolveInvocationWorkspace.mockImplementati
 )
 
 const principal = createPersonalApiKeyPrincipal({ userId: 'reader', keyId: 'fixture-key' })
+const CHAT = createCopilotChatPrincipal(
+  { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
+  WORKSPACE_FILES_DELEGATION_AUDIENCE
+)
+
+function fileSource(id: string, provenance: ContentSource['provenance']): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view: 'opaque' }
+}
 const content = 'PRIVATE_FILE_CANARY_FOR_LOCAL_TEST'
 const revision = new Date('2026-09-06T00:00:00Z')
 const file = {
@@ -131,8 +149,21 @@ function grepFiles(pattern: string): CliInvocation {
   return { kind: 'augmentation', name: 'grep', positionals: [pattern], flags: { scope: 'files' } }
 }
 
+/**
+ * The CLI handler as the tool executor runs it: under the gate bound to the call's registry, which
+ * augmentation engines that call use cases in-process rely on.
+ */
+function simCli(...[params, context]: Parameters<typeof executeSimCli>) {
+  const gate = createRegistryContentGate({
+    registry: context.resolvedSecretTraceRegistry,
+    workspaceId: context.workspaceId,
+    actorUserId: context.userId,
+  })
+  return observeContentDelivery(gate, () => executeSimCli(params, context))
+}
+
 function runCli(invocation: CliInvocation, trace = registry()) {
-  return executeSimCli(
+  return simCli(
     { request: { invocation } },
     {
       userId: 'reader',
@@ -144,12 +175,19 @@ function runCli(invocation: CliInvocation, trace = registry()) {
   )
 }
 
-function readTransport(trace = registry()) {
-  return createFileReadTransport({
+const invocation = { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' }
+
+/** Chat's CLI transport as every invocation composes it: the registry gate around the routes. */
+function readTransport(trace = registry()): typeof fetch {
+  const transport = createAgentCliTransport({
     endpoint: 'https://sim.test',
-    userId: 'reader',
+    invocation,
     registry: trace,
+    resources: [],
+    observeReads: true,
   })
+  return (input, init) =>
+    withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () => transport(input, init))
 }
 
 function fileRequest(suffix = '', signal?: AbortSignal) {
@@ -202,15 +240,8 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       billedAccountUserId: 'owner',
     })
     classify('exact')
-    const transport = createFileReadTransport({
-      endpoint: 'https://sim.test',
-      userId: 'reader',
-      registry: registry(),
-      invocation: { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
-    })
-    const response = await withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
-      transport(fileRequest())
-    )
+    const transport = readTransport()
+    const response = await transport(fileRequest())
     expect(response.status).toBe(200)
     expect(await response.text()).toBe(content)
     expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
@@ -221,19 +252,26 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       allowPersonalApiKeys: false,
       billedAccountUserId: 'other',
     })
-    const denied = await withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
-      transport(fileRequest())
-    )
+    const denied = await transport(fileRequest())
     expect(denied.status).toBe(404)
     expect(mocks.stream).toHaveBeenCalledTimes(1)
   })
 
   it('refuses an otherwise authorized visual observation using the stored classification', async () => {
+    const gate = createRegistryContentGate({
+      registry: registry(),
+      workspaceId: 'workspace',
+      actorUserId: 'reader',
+    })
     await expect(
-      readWorkspaceFileArtifact.execute({
-        principal,
-        input: { workspaceId: 'workspace', reference: 'file', maxBytes: 1024 },
-      })
+      withWorkspaceInvocationScope({ workspaceId: 'workspace' }, () =>
+        observeContentDelivery(gate, () =>
+          readWorkspaceFileArtifact.execute({
+            principal: CHAT,
+            input: { workspaceId: 'workspace', reference: 'file', maxBytes: 1024 },
+          })
+        )
+      )
     ).rejects.toThrow('File cannot be sent to a model')
     expect(mocks.render).not.toHaveBeenCalled()
     expect(mocks.stream).not.toHaveBeenCalled()
@@ -247,7 +285,7 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
         { userId: 'reader', workspaceId: 'workspace' }
       )
       if (active) registry.recordResolved('FILE_SECRET', content, { propagated: true })
-      const result = await executeSimCli(
+      const result = await simCli(
         {
           request: {
             invocation: { kind: 'cli', argv: ['files', 'get', 'file'] },
@@ -280,17 +318,14 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     const projection = inspectToolResultForCopilot({ success: true, output }, trace, 'sim_cli')
     expect(JSON.stringify(projection.result)).toContain(content)
     expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(v2RouteMocks.authenticate).toHaveBeenCalledWith({
-      apiKey: 'fixture',
-      bearer: null,
-      malformedOAuthBearer: false,
-    })
+    /** Chat reads as its invocation's delegation, never as the credential a request carries. */
+    expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
   })
 
   it('keeps exact-empty file contents readable through the actual CLI handler', async () => {
     classify('exact')
     const trace = registry()
-    const result = await executeSimCli(
+    const result = await simCli(
       {
         request: {
           invocation: { kind: 'cli', argv: ['files', 'get', 'file'] },
@@ -311,26 +346,23 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.stream).toHaveBeenCalledTimes(1)
   })
 
-  it('refuses a forwarded response naming its unknown file, without blanking the invocation', async () => {
+  it('refuses only the unknown item of a forwarded response, naming it, without blanking the invocation', async () => {
     const refusals = getMockLogger('DurableSecretProvenancePersistence').error
     refusals.mockClear()
-    const trace = registry()
-    const transport = createFileReadTransport({
-      endpoint: 'https://sim.test',
-      userId: 'reader',
-      registry: trace,
-      invocation: { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' },
-      transport: async () => {
-        await reportWorkspaceFileDelivery({ status: 'exact', entries: [] }, 'clean')
-        await reportWorkspaceFileDelivery({ status: 'unknown' }, 'tainted')
-        return new Response(content)
-      },
+    const clean = fileSource('clean', { status: 'exact', entries: [] })
+    const tainted = fileSource('tainted', { status: 'unknown' })
+    let verdicts: boolean[] = []
+    vi.stubGlobal('fetch', async () => {
+      const admission = await admitContent(CHAT, [clean, tainted])
+      verdicts = [admission.admits(clean), admission.admits(tainted)]
+      return new Response('clean item')
     })
-    const response = await transport(
-      new Request('https://sim.test/api/v2/files/bulk-download?workspaceId=workspace')
+    const trace = registry()
+    const response = await readTransport(trace)(
+      'https://sim.test/api/v2/files/bulk-download?workspaceId=workspace'
     )
-    expect(response.status).toBe(403)
-    expect(await response.text()).not.toContain(content)
+    expect(response.status).toBe(200)
+    expect(verdicts).toEqual([true, false])
     expect(trace.isPermanentlyIncomplete()).toBe(false)
     expect(refusals).toHaveBeenCalledTimes(1)
     expect(refusals).toHaveBeenCalledWith(
@@ -339,6 +371,20 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     )
   })
 
+  it('refuses a successful forwarded response its sourced operation never classified', async () => {
+    vi.stubGlobal('fetch', async () => {
+      noteContentDeliveryOperation(fileOperations.download, CHAT)
+      return new Response(content)
+    })
+    const trace = registry()
+    const response = await readTransport(trace)(
+      'https://sim.test/api/v2/files/bulk-download?workspaceId=workspace'
+    )
+    expect(response.status).toBe(403)
+    expect(await response.text()).not.toContain(content)
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+  })
+
   it('refuses extracted text whose canonical revision changed before loading its bytes', async () => {
     resetDbChainMock()
     queueTableRows(workspaceFiles, [sidecarRow('exact', new Date(revision.getTime() + 1))])
@@ -497,6 +543,91 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     )
   })
 
+  describe('grep reshapes a file line only after redacting it', () => {
+    const secret = 'sk_live_P3_FIXTURE_0123456789abcdefghij'
+    const otherSecret = 'pk_test_P3_FIXTURE_ZYXWVUTSRQPONMLKJIH'
+    const keyBlock = [
+      '-----BEGIN FIXTURE KEY-----',
+      'MIIBFIXTUREKEYLINEONE0123456789',
+      'MIIBFIXTUREKEYLINETWO0123456789',
+      '-----END FIXTURE KEY-----',
+    ].join('\n')
+    const LINE_CHARS = 2_000
+    const pad = (from: number, to: number) => 'x'.repeat(to - from)
+
+    /** A secret leaks as soon as its first or last four characters, or one of its lines, cross. */
+    function fragments(value: string): string[] {
+      return [value.slice(0, 4), value.slice(-4), ...value.split('\n')]
+    }
+
+    async function grepSecretFile(text: string, pattern: string) {
+      const plaintexts: Record<string, string> = {
+        'cipher-file': secret,
+        'cipher-other': otherSecret,
+        'cipher-key': keyBlock,
+      }
+      mocks.decrypt.mockImplementation(async (cipher: string) => ({
+        decrypted: plaintexts[cipher],
+      }))
+      mocks.buffer.mockResolvedValue(Buffer.from(text))
+      vi.stubGlobal('fetch', async () =>
+        Response.json({
+          data: [{ ...file, size: Buffer.byteLength(text), updatedAt: revision.toISOString() }],
+          nextCursor: null,
+        })
+      )
+      resetDbChainMock()
+      queueTableRows(workspaceFiles, [
+        sidecarRow('exact', revision, [
+          { name: 'FILE_SECRET', encryptedValue: 'cipher-file', sourceUserId: 'reader' },
+          { name: 'OTHER_SECRET', encryptedValue: 'cipher-other', sourceUserId: 'reader' },
+          { name: 'KEY_BLOCK', encryptedValue: 'cipher-key', sourceUserId: 'reader' },
+        ]),
+      ])
+      const trace = registry()
+      const result = await runCli(grepFiles(pattern), trace)
+      const projection = inspectToolResultForCopilot(result, trace, 'sim_cli')
+      expect(projection.safe).toBe(true)
+      return JSON.stringify(projection.result)
+    }
+
+    it.each([
+      ['straddling the clip', `NEEDLE ${pad(7, LINE_CHARS - 10)}${secret} tail`],
+      [
+        'whose redaction marker would straddle the clip',
+        `NEEDLE ${pad(7, LINE_CHARS - 5)}${secret}`,
+      ],
+      ['wholly past the clip', `NEEDLE ${pad(7, LINE_CHARS + 50)}${secret} tail`],
+      [
+        'repeated around the clip with another secret',
+        `NEEDLE ${otherSecret} ${pad(48, LINE_CHARS - 12)}${secret}${otherSecret}${secret}`,
+      ],
+    ])('never returns a fragment of a secret %s', async (_case, line) => {
+      const projected = await grepSecretFile(`${line}\nsecond line`, 'NEEDLE')
+      expect(projected).toContain('NEEDLE')
+      expect(projected).toContain('[line truncated]')
+      for (const fragment of [...fragments(secret), ...fragments(otherSecret)]) {
+        expect(projected).not.toContain(fragment)
+      }
+      const withoutMarkers = projected
+        .replaceAll('{{FILE_SECRET}}', '')
+        .replaceAll('{{OTHER_SECRET}}', '')
+        .replaceAll('[REDACTED_SECRET]', '')
+      expect(withoutMarkers).not.toContain('{{')
+      expect(withoutMarkers).not.toContain('[RED')
+    })
+
+    it('never returns one line of a multi-line secret', async () => {
+      const projected = await grepSecretFile(
+        `config start\n${keyBlock}\nconfig end`,
+        'FIXTURE KEY|KEYLINE'
+      )
+      for (const fragment of fragments(keyBlock)) expect(projected).not.toContain(fragment)
+      const footer = await grepSecretFile(`config start\n${keyBlock}\nconfig end`, 'config end')
+      expect(footer).toContain(':6: config end')
+    })
+  })
+
   it('refuses an unknown file through the actual CLI text read without loading its bytes', async () => {
     classify('unknown')
     const result = await runCli(readFile)
@@ -532,7 +663,7 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
       .png()
       .toBuffer()
     mocks.render.mockResolvedValue({ buffer: png, contentType: 'image/png' })
-    const result = await executeSimCli(
+    const result = await simCli(
       {
         request: {
           invocation: {
@@ -565,16 +696,6 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.buffer).not.toHaveBeenCalled()
   })
 
-  it('rejects a credential for a different actor before looking up the file', async () => {
-    v2RouteMocks.authenticate.mockResolvedValue({
-      principal: { ...principal, userId: 'someone-else' },
-    })
-    const response = await readTransport()(fileRequest())
-    expect(response.status).toBe(401)
-    expect(mocks.context).not.toHaveBeenCalled()
-    expect(mocks.stream).not.toHaveBeenCalled()
-  })
-
   it.each([
     'https://sim.test/api/v2/files/folders',
     'https://sim.test/api/v2/files/bulk-download',
@@ -582,8 +703,12 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     'https://other.test/api/v2/files/file',
   ])('leaves unrelated requests to the existing transport: %s', async (url) => {
     const fallback = vi.fn(async () => new Response('fallback'))
-    vi.stubGlobal('fetch', fallback)
-    expect(await (await readTransport()(url)).text()).toBe('fallback')
+    const transport = createFileReadTransport({
+      endpoint: 'https://sim.test',
+      transport: fallback,
+      invocation,
+    })
+    expect(await (await transport(url)).text()).toBe('fallback')
     expect(fallback).toHaveBeenCalledWith(url, undefined)
     expect(v2RouteMocks.authenticate).not.toHaveBeenCalled()
   })
@@ -596,13 +721,10 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     expect(mocks.context).not.toHaveBeenCalled()
   })
 
-  it('does not begin a file lookup after Stop during authentication', async () => {
+  it('does not begin a file lookup after Stop before dispatch', async () => {
     const controller = new AbortController()
     const stopped = new Error('Stopped')
-    v2RouteMocks.authenticate.mockImplementation(async () => {
-      controller.abort(stopped)
-      return { principal }
-    })
+    controller.abort(stopped)
     await expect(readTransport()(fileRequest('', controller.signal))).rejects.toBe(stopped)
     expect(mocks.context).not.toHaveBeenCalled()
   })
diff --git a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
index 436ec74380d..fcc56801d63 100644
--- a/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/file-read-transport.ts
@@ -1,165 +1,71 @@
 import { createLogger } from '@sim/logger'
 import { NextRequest } from 'next/server'
-import {
-  v2BulkDownloadFilesContract,
-  v2DownloadFileContract,
-  v2ListFileFoldersContract,
-  v2ReadFileTextContract,
-} from '@/lib/api/contracts/v2/files'
-import {
-  authenticateV2ApiKey,
-  V2ApiKeyUnauthenticatedError,
-} from '@/lib/api/server/routes/v2-api-key-auth'
-import { readV2CredentialHeaders } from '@/lib/api/server/routes/v2-credential-headers'
+import { v2DownloadFileContract, v2ReadFileTextContract } from '@/lib/api/contracts/v2/files'
+import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { V2_PARSE_DEFAULTS } from '@/lib/api/server/routes/v2-json-route'
 import { parseRequest } from '@/lib/api/server/validation'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { observeContentDelivery } from '@/lib/core/application'
 import {
   type CopilotChatDelegationContext,
   createCopilotChatPrincipal,
 } from '@/lib/mothership/auth/application-delegation'
-import {
-  importWorkspaceFileSnapshotProvenance,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-  mergeWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { v2FileErrorPolicies } from '@/lib/workspace-files/api'
 import { presentWorkspaceFileText } from '@/lib/workspace-files/api/text-presenter'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/download-workspace-file'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 import { readWorkspaceFileText } from '@/lib/workspace-files/application/read-workspace-file-text'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('MothershipFileReads')
 
-/** Private file-read metadata stays in the authenticated host; the CLI consumes its usual wire shape. */
+/** Contract paths in the generated route table's `{param}` pattern syntax. */
+const routePattern = (path: string) => path.replace(/\[([^\]]+)\]/g, '{$1}')
+const DOWNLOAD_PATTERN = routePattern(v2DownloadFileContract.path)
+const TEXT_PATTERN = routePattern(v2ReadFileTextContract.path)
+
+/**
+ * Answers the two single-file reads Chat needs beyond their public routes — a chat upload by its
+ * `uploads/` reference and plain source decoded as text — by calling their use cases directly.
+ * Every other request, file collections included, goes to the route the generated table names.
+ *
+ * Classification is not decided here: the gate the caller installed decides each file. A direct
+ * download alone takes the single-file exception (D7): an unknown file is delivered with the whole
+ * invocation withheld, and the workbench copy keeps the unknown classification.
+ */
 export function createFileReadTransport(context: {
   endpoint: string
-  transport?: typeof fetch
-  userId: string
-  invocation?: CopilotChatDelegationContext
-  chatId?: string
+  transport: typeof fetch
+  invocation: CopilotChatDelegationContext & { workspaceId: string }
   registry?: ResolvedSecretTraceRegistry
-  trackDownload?: (
-    stream: ReadableStream<Uint8Array>,
-    provenance?: WorkspaceFileSecretProvenance
-  ) => void
 }): typeof fetch {
   const base = new URL(context.endpoint)
   const basePath = base.pathname.replace(/\/$/, '')
-  const prefix = `${basePath}${v2DownloadFileContract.path.split('[fileId]')[0]}`
-  const collectionPaths = new Set([
-    `${basePath}${v2ListFileFoldersContract.path}`,
-    `${basePath}${v2BulkDownloadFilesContract.path}`,
-  ])
-  /**
-   * Admits one delivery's classification into the invocation registry. A delivery it refuses is
-   * either withheld (text and forwarded responses reach only the model, so refusing them is enough)
-   * or, for a direct download whose bytes can be persisted, delivered with the whole invocation
-   * marked incomplete so anything derived from the copy keeps the unknown classification.
-   */
-  const admit = async (
-    workspaceId: string,
-    provenance: WorkspaceFileSecretProvenance | undefined,
-    resourceId?: string
-  ): Promise<boolean> =>
-    provenance !== undefined &&
-    (await importWorkspaceFileSnapshotProvenance({
-      workspaceId,
-      provenance,
-      registry: context.registry,
-      actorUserId: context.userId,
-      resourceId,
-    }))
-  const refused = () =>
-    v2FileErrorPolicies.concealResourceAuthorization.render(
-      new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-    ) ??
-    Response.json(
-      { error: { message: MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE } },
-      { status: 403 }
-    )
 
-  const forward: typeof fetch = async (input, init) => {
+  return async (input, init) => {
     const url = new URL(input instanceof Request ? input.url : input)
     const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    if (!context.invocation || method !== 'GET' || url.origin !== base.origin) {
-      return (context.transport ?? fetch)(input, init)
-    }
-    let provenance: WorkspaceFileSecretProvenance | undefined
-    const deliveries: { source: WorkspaceFileSecretProvenance | undefined; fileId: string }[] = []
-    const response = await observeWorkspaceFileDelivery(
-      async (source, fileId) => {
-        deliveries.push({ source, fileId })
-        provenance = mergeWorkspaceFileSecretProvenance(
-          provenance ?? { status: 'exact', entries: [] },
-          source ?? { status: 'unknown' }
-        )
-      },
-      () => (context.transport ?? fetch)(input, init)
-    )
-    if (!provenance) return response
-    try {
-      if (!context.registry) {
-        await response.body?.cancel().catch(() => {})
-        return Response.json(
-          { error: { message: 'File read provenance is unavailable. Retry the read.' } },
-          { status: 503 }
-        )
+    let route: ReturnType<typeof matchV2Route> = null
+    if (method === 'GET' && url.origin === base.origin && url.pathname.startsWith(`${basePath}/`)) {
+      try {
+        route = matchV2Route(url.pathname.slice(basePath.length))
+      } catch {
+        /** A malformed percent encoding names no file; the route answers it. */
       }
-      /** Each delivery is admitted under its own file id, so a refusal names the file it refused. */
-      for (const { source, fileId } of deliveries) {
-        if (!(await admit(context.invocation.workspaceId, source, fileId))) {
-          await response.body?.cancel().catch(() => {})
-          return refused()
-        }
-      }
-      if (response.body) context.trackDownload?.(response.body, provenance)
-      return response
-    } catch (error) {
-      await response.body?.cancel().catch(() => {})
-      throw error
     }
-  }
-
-  return async (input, init) => {
-    const url = new URL(input instanceof Request ? input.url : input)
-    const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    if (
-      method !== 'GET' ||
-      url.origin !== base.origin ||
-      !url.pathname.startsWith(prefix) ||
-      collectionPaths.has(url.pathname)
-    ) {
-      return forward(input, init)
+    if (!route || (route.pattern !== DOWNLOAD_PATTERN && route.pattern !== TEXT_PATTERN)) {
+      return context.transport(input, init)
     }
-    const match = /^([^/]+)(\/text)?$/.exec(url.pathname.slice(prefix.length))
-    if (!match) return forward(input, init)
     const request = new NextRequest(new Request(input, init))
     let stream: ReadableStream<Uint8Array> | undefined
     try {
       request.signal.throwIfAborted()
-      const principal = context.invocation
-        ? createCopilotChatPrincipal(context.invocation, WORKSPACE_FILES_DELEGATION_AUDIENCE)
-        : (await authenticateV2ApiKey(readV2CredentialHeaders(request.headers))).principal
-      request.signal.throwIfAborted()
-      if (
-        principal.kind === 'delegated'
-          ? principal.subjectUserId !== context.userId
-          : principal.kind !== 'personal_api_key' || principal.userId !== context.userId
-      ) {
-        throw new V2ApiKeyUnauthenticatedError()
-      }
-      if (!context.registry) {
-        return Response.json(
-          { error: { message: 'File read provenance is unavailable. Retry the read.' } },
-          { status: 503 }
-        )
-      }
-      const params = { fileId: decodeURIComponent(match[1] ?? '') }
-      if (match[2]) {
+      const principal = createCopilotChatPrincipal(
+        context.invocation,
+        WORKSPACE_FILES_DELEGATION_AUDIENCE
+      )
+      const params = { fileId: route.params.fileId ?? '' }
+      if (route.pattern === TEXT_PATTERN) {
         const parsed = await parseRequest(
           v2ReadFileTextContract,
           request,
@@ -168,27 +74,20 @@ export function createFileReadTransport(context: {
         )
         if (!parsed.success) return parsed.response
         request.signal.throwIfAborted()
-        const result = await observeWorkspaceFileDelivery(
-          async (source, fileId) => {
-            if (!(await admit(parsed.data.query.workspaceId, source, fileId))) {
-              throw new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-            }
+        const result = await readWorkspaceFileText.execute({
+          principal,
+          input: {
+            workspaceId: parsed.data.query.workspaceId,
+            reference: parsed.data.params.fileId,
+            ...(context.invocation.chatId !== undefined
+              ? { chatId: context.invocation.chatId }
+              : {}),
+            maxBytes: parsed.data.query.maxBytes,
+            offset: parsed.data.query.offset,
+            limit: parsed.data.query.limit,
+            allowPlainText: true,
           },
-          () =>
-            readWorkspaceFileText.execute({
-              principal,
-              input: {
-                workspaceId: parsed.data.query.workspaceId,
-                reference: parsed.data.params.fileId,
-                ...(context.chatId !== undefined ? { chatId: context.chatId } : {}),
-                maxBytes: parsed.data.query.maxBytes,
-                offset: parsed.data.query.offset,
-                limit: parsed.data.query.limit,
-                includeSecretProvenance: true,
-                allowPlainText: true,
-              },
-            })
-        )
+        })
         request.signal.throwIfAborted()
         return Response.json(presentWorkspaceFileText(result))
       }
@@ -200,44 +99,33 @@ export function createFileReadTransport(context: {
       )
       if (!parsed.success) return parsed.response
       request.signal.throwIfAborted()
-      const result = await observeWorkspaceFileDelivery(
-        async (source, fileId) => {
-          if (!(await admit(parsed.data.query.workspaceId, source, fileId))) {
-            context.registry?.markIncomplete('workspace-file-provenance-unknown')
-          }
-        },
+      const result = await observeContentDelivery(
+        createRegistryContentGate({
+          registry: context.registry,
+          workspaceId: parsed.data.query.workspaceId,
+          actorUserId: context.invocation.userId,
+          unknown: 'taint',
+        }),
         () =>
           downloadWorkspaceFileStream.execute({
             principal,
             input: {
               fileId: parsed.data.params.fileId,
               assertedWorkspaceId: parsed.data.query.workspaceId,
-              includeSecretProvenance: true,
             },
           })
       )
       stream = result.stream
       request.signal.throwIfAborted()
-      const response = new Response(
-        stream.pipeThrough(new TransformStream(), { signal: request.signal }),
-        {
-          headers: {
-            'content-type': result.contentType,
-            'content-length': String(result.contentLength),
-          },
-        }
-      )
-      if (response.body) context.trackDownload?.(response.body, result.secretProvenance)
-      return response
+      return new Response(stream.pipeThrough(new TransformStream(), { signal: request.signal }), {
+        headers: {
+          'content-type': result.contentType,
+          'content-length': String(result.contentLength),
+        },
+      })
     } catch (error) {
       await stream?.cancel().catch(() => {})
       request.signal.throwIfAborted()
-      if (error instanceof V2ApiKeyUnauthenticatedError) {
-        return Response.json(
-          { error: { code: 'UNAUTHORIZED', message: error.message } },
-          { status: 401 }
-        )
-      }
       const response = v2FileErrorPolicies.concealResourceAuthorization.render(error)
       if (response) return response
       logger.error('File read failed', { error })
diff --git a/apps/sim/lib/mothership/agent-cli/index.ts b/apps/sim/lib/mothership/agent-cli/index.ts
index 21ac35f2926..4d7a7b525dd 100644
--- a/apps/sim/lib/mothership/agent-cli/index.ts
+++ b/apps/sim/lib/mothership/agent-cli/index.ts
@@ -141,6 +141,7 @@ async function executeBoundAgentCliRequest(
               }
             : {}),
           ...(context.chatId !== undefined ? { chatId: context.chatId } : {}),
+          resolvedSecretTraceRegistry: context.resolvedSecretTraceRegistry,
           signal: context.signal,
         },
         invocation.flags
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
index deadfa63b70..25287a6e7cf 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.test.ts
@@ -1,6 +1,7 @@
 import { runEmbeddedCli } from 'sim/embed'
 import { describe, expect, it, vi } from 'vitest'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
+import { markCommittedWriteResponse } from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 
 const endpoint = 'https://sim.test'
@@ -43,6 +44,18 @@ describe('confirmed CLI resource effects', () => {
     expect(await effectsFor(path, 'GET')).toEqual([])
   })
 
+  it('refreshes what a committed write changed even when its result was withheld', async () => {
+    const effects: ResourceChange[] = []
+    const withheld = markCommittedWriteResponse(
+      Response.json({ error: 'The change was saved' }, { status: 403 })
+    )
+    const transport = createResourceEffectTransport(endpoint, async () => withheld, effects)
+    await transport(`${endpoint}/api/v2/tables/t/rows/r`, { method: 'PATCH' })
+    expect(effects).toEqual([{ op: 'upsert', resource: { type: 'table', id: 't' } }])
+    /** A refusal that changed nothing changes nothing. */
+    expect(await effectsFor('tables/t/rows/r', 'PATCH', {}, 403)).toEqual([])
+  })
+
   it.each([
     ['/', 'Report (final).md', 'files/Report%20(final).md'],
     ['/A%2FB/100%25', 'notes.md', 'files/A%2FB/100%25/notes.md'],
diff --git a/apps/sim/lib/mothership/agent-cli/resource-effects.ts b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
index b397022a51c..4d76da4ecd4 100644
--- a/apps/sim/lib/mothership/agent-cli/resource-effects.ts
+++ b/apps/sim/lib/mothership/agent-cli/resource-effects.ts
@@ -15,6 +15,7 @@ import * as secrets from '@/lib/api/contracts/v2/secrets'
 import * as tables from '@/lib/api/contracts/v2/tables'
 import * as workflows from '@/lib/api/contracts/v2/workflows'
 import { parseFolderPath } from '@/lib/folders/paths'
+import { isCommittedWriteResponse } from '@/lib/mothership/content-delivery'
 import type { ResourceAddress, ResourceChange } from '@/lib/mothership/generated/resources'
 import { findNonTabFileIds } from '@/lib/mothership/resources/file-tabs'
 import { encodeVfsPathSegments } from '@/lib/vfs/path'
@@ -31,6 +32,8 @@ interface EffectRoute {
   path: string
   readBody?: boolean
   readOnly?: boolean
+  /** Projects from the request alone, so a committed write whose result was withheld still counts. */
+  fromRequest?: boolean
   project: (response: Response, context: EffectContext) => Promise<ResourceChange[]>
 }
 
@@ -99,6 +102,7 @@ function parentAccess(
         method: value.method,
         path: value.path,
         readOnly,
+        fromRequest: true,
         async project(_response: Response, context: EffectContext) {
           /** Literal collection routes also match, preventing /folders from becoming an ID. */
           const id = context.params[parameter]
@@ -389,7 +393,10 @@ export function createResourceEffectTransport(
           : undefined
       : undefined
     const response = await transport(input, init)
-    if (route && response.ok && (!route.readOnly || observeReads)) {
+    const changed =
+      response.ok ||
+      (route?.fromRequest === true && !route.readOnly && isCommittedWriteResponse(response))
+    if (route && changed && (!route.readOnly || observeReads)) {
       const params = matchParams(route.path, url.pathname)
       if (params)
         effects.push(...(await onlyFileTabs(await route.project(response, { params, body }))))
diff --git a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
index da012151319..57c19ffd4e3 100644
--- a/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
+++ b/apps/sim/lib/mothership/agent-cli/saved-run-read.live.test.ts
@@ -28,6 +28,7 @@ import { db } from '@sim/db'
 import {
   auditLog,
   copilotAsyncToolCalls,
+  copilotAsyncToolCallsPersistSeq,
   copilotChats,
   copilotMessages,
   copilotRequestStops,
@@ -82,6 +83,7 @@ import {
   v2ExecuteWorkflowDataSchema,
   v2WorkflowRunStatusSchema,
 } from '@/lib/api/contracts/v2/workflows'
+import { observeContentDelivery } from '@/lib/core/application'
 import { env } from '@/lib/core/config/env'
 import { clearLargeValueCacheForTests } from '@/lib/execution/payloads/cache'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
@@ -127,6 +129,7 @@ import {
   resolveActiveResourceContext,
 } from '@/lib/mothership/chat/process-contents'
 import { finalizeAssistantTurn } from '@/lib/mothership/chat/terminal-state'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { prepareInboxAttachments } from '@/lib/mothership/inbox/attachments'
 import { claimRunController } from '@/lib/mothership/request/lifecycle/controller-ownership'
 import { runCopilotLifecycle } from '@/lib/mothership/request/lifecycle/run'
@@ -1171,6 +1174,10 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
     beforeAll(async () => {
       fixture.directory = await mkdtemp(join(tmpdir(), 'mship-run-logs-'))
       await db.execute(sql`CREATE SCHEMA ${sql.identifier(schemaName)}`)
+      const persistSequenceName = copilotAsyncToolCallsPersistSeq.seqName
+      if (!persistSequenceName) throw new Error('Tool-call persistence sequence has no name')
+      const persistSequence = sql`${sql.identifier(schemaName)}.${sql.identifier(persistSequenceName)}`
+      await db.execute(sql`CREATE SEQUENCE ${persistSequence}`)
       for (const table of tables) {
         const config = getTableConfig(table)
         const columns = config.columns.map((column) => {
@@ -1185,6 +1192,9 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
           sql`CREATE TABLE ${sql.identifier(config.name)} (${sql.join(columns, sql`, `)})`
         )
       }
+      await db.execute(
+        sql`ALTER SEQUENCE ${persistSequence} OWNED BY ${sql.identifier(schemaName)}.${sql.identifier(getTableConfig(copilotAsyncToolCalls).name)}.${sql.identifier(copilotAsyncToolCalls.persistSeq.name)}`
+      )
       await db.execute(
         sql`ALTER TABLE workflow_execution_snapshots ALTER COLUMN created_at SET DEFAULT now()`
       )
@@ -1287,7 +1297,7 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
       await Promise.all(postExecution.mock.calls.map(([promise]) => promise))
     })
     afterAll(async () => {
-      postExecution.mockRestore()
+      postExecution?.mockRestore()
       controlServer?.closeAllConnections()
       if (controlServer) await new Promise<void>((resolve) => controlServer.close(() => resolve()))
       try {
@@ -2644,6 +2654,15 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
       async (extension) => {
         const name = `shared-${generateId()}.${extension}`
         const chats = [generateId(), generateId()]
+        const emptyChatId = generateId()
+        await db.insert(copilotChats).values(
+          [...chats, emptyChatId].map((id) => ({
+            id,
+            workspaceId,
+            userId: 'run-reader',
+            type: 'mothership' as const,
+          }))
+        )
         const attachmentIds = [generateId(), generateId()]
         const fileIds: string[] = []
         try {
@@ -2679,34 +2698,43 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               .where(eq(workspaceFiles.key, prepared.storedAttachments[0].key))
             fileIds.push(row.id)
           }
-          const read = async (chatId: string) =>
-            executeAgentCliRequest(
-              {
-                invocation:
-                  extension === 'pdf'
-                    ? {
-                        kind: 'augmentation',
-                        name: 'files view',
-                        positionals: [`uploads/${encodeURIComponent(name)}`],
-                        flags: {},
-                      }
-                    : {
-                        kind: 'cli',
-                        argv: ['files', 'read', `uploads/${encodeURIComponent(name)}`],
-                      },
-              },
-              {
-                workspaceId,
-                userId: 'run-reader',
-                chatId,
-                resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
-                  userId: 'run-reader',
-                  workspaceId,
-                }),
-              }
+          const read = async (chatId: string) => {
+            const registry = new ResolvedSecretTraceRegistry([], {
+              userId: 'run-reader',
+              workspaceId,
+            })
+            return observeContentDelivery(
+              createRegistryContentGate({ registry, actorUserId: 'run-reader', workspaceId }),
+              () =>
+                executeAgentCliRequest(
+                  {
+                    invocation:
+                      extension === 'pdf'
+                        ? {
+                            kind: 'augmentation',
+                            name: 'files view',
+                            positionals: [`uploads/${encodeURIComponent(name)}`],
+                            flags: {},
+                          }
+                        : {
+                            kind: 'cli',
+                            argv: ['files', 'read', `uploads/${encodeURIComponent(name)}`],
+                          },
+                  },
+                  {
+                    workspaceId,
+                    userId: 'run-reader',
+                    chatId,
+                    resolvedSecretTraceRegistry: registry,
+                  }
+                )
             )
+          }
           const first = await read(chats[0])
-          expect(first.exitCode, first.stderr).toBe(0)
+          expect(
+            first.exitCode,
+            JSON.stringify({ stderr: first.stderr, errors: fixture.errors })
+          ).toBe(0)
           const second = await read(chats[1])
           expect(second.exitCode, second.stderr).toBe(0)
           if (extension === 'csv') {
@@ -2724,7 +2752,7 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               )
             }
           }
-          const absent = await read(generateId())
+          const absent = await read(emptyChatId)
           expect(absent.exitCode).not.toBe(0)
           expect(absent.stdout).not.toContain('second')
           expect(absent.observations).toBeUndefined()
@@ -2744,13 +2772,19 @@ describe.skipIf(!process.env.MSHIP_TEST_DATABASE_URL)(
               { workspaceId, reference }
             )
             expect(mediaReference.id).toBe(fileIds[index])
-            const mounts = await resolveInputFiles(
-              context,
-              [{ path: reference, sandboxPath: '/tmp/incoming.csv' }],
-              undefined,
-              undefined,
-              new ResolvedSecretTraceRegistry([], { userId: 'run-reader', workspaceId })
+            const { files: mounts, excluded } = await observeContentDelivery(
+              createRegistryContentGate({
+                registry: new ResolvedSecretTraceRegistry([], {
+                  userId: 'run-reader',
+                  workspaceId,
+                }),
+                actorUserId: 'run-reader',
+                workspaceId,
+              }),
+              () =>
+                resolveInputFiles(context, [{ path: reference, sandboxPath: '/tmp/incoming.csv' }])
             )
+            expect(excluded).toEqual([])
             expect(mounts).toHaveLength(1)
             const mount = mounts[0]
             if (mount.type === 'url') throw new Error('Expected inline mount bytes')
diff --git a/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts b/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts
deleted file mode 100644
index 944faec6b47..00000000000
--- a/apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts
+++ /dev/null
@@ -1,287 +0,0 @@
-import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
-import {
-  mothershipWorkspaceTargetMock,
-  mothershipWorkspaceTargetMockFns,
-} from '@sim/testing/mocks/mothership-workspace-target.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const hoisted = vi.hoisted(() => ({ scoped: vi.fn() }))
-vi.mock('@/lib/core/security/encryption', () => encryptionMock)
-vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
-  createScopedCliTransport: () => hoisted.scoped,
-}))
-vi.mock('@/lib/mothership/application/workspace-target', () => mothershipWorkspaceTargetMock)
-vi.mock('@/lib/execution/remote-sandbox/session-files', () => ({
-  SESSION_SANDBOX_HOME: '/home/user',
-  readSessionSandboxFile: vi.fn(),
-  writeSessionSandboxFile: vi.fn(),
-}))
-vi.mock('@/lib/execution/remote-sandbox/session-file-snapshot', () => ({
-  openSessionFileSnapshot: vi.fn(),
-}))
-
-import { V2_ROUTES } from '@/lib/api/server/routes/v2-route-table.generated'
-import {
-  createTableReadTransport,
-  TABLE_ROUTES_WITHOUT_ROW_DATA,
-} from '@/lib/mothership/agent-cli/table-read-transport'
-import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
-import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
-import { reportTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
-
-const mocks = { ...hoisted, decrypt: encryptionMockFns.mockDecryptSecret }
-
-mothershipWorkspaceTargetMockFns.mockResolveInvocationWorkspace.mockImplementation(
-  async (owner: { userId: string }, workspaceId?: string) => ({
-    workspaceId: workspaceId ?? 'workspace',
-    userId: owner.userId,
-  })
-)
-
-const SECRET = 'PRIVATE_TABLE_CELL_CANARY_FOR_LOCAL_TEST'
-const scope = { userId: 'reader', workspaceId: 'workspace' }
-const endpoint = 'https://sim.test'
-const rowUrl = `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`
-const rowBody = { data: { id: 'row', data: { token: SECRET } } }
-
-function registry() {
-  return new ResolvedSecretTraceRegistry([], scope)
-}
-
-function secretProvenance() {
-  const source = new ResolvedSecretTraceRegistry(
-    [{ name: 'TABLE_SECRET', plaintext: SECRET, encryptedValue: 'fixture-ciphertext' }],
-    scope
-  )
-  source.recordResolved('TABLE_SECRET', SECRET, { propagated: true })
-  return source.exportProvenance()
-}
-
-/** Stands in for a v2 table route whose use case reports the rows it returns. */
-async function deliveringRoute() {
-  await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
-  return Response.json(rowBody)
-}
-
-function projected(output: string, trace: ResolvedSecretTraceRegistry) {
-  return JSON.stringify(inspectToolResultForCopilot({ success: true, output }, trace, 'sim_cli'))
-}
-
-describe('table provenance at the CLI and model-result boundary', () => {
-  beforeEach(() => {
-    mocks.decrypt.mockResolvedValue({ decrypted: SECRET })
-  })
-
-  it('activates reported row provenance so the model projection redacts the cell', async () => {
-    const trace = registry()
-    const inner = vi.fn(deliveringRoute)
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: inner,
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    const output = await response.text()
-    expect(output).toBe(JSON.stringify(rowBody))
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(projected(output, trace)).not.toContain(SECRET)
-  })
-
-  it('withholds a row-bearing result that reported no provenance', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () => Response.json(rowBody),
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
-    expect(projected(await response.text(), trace)).not.toContain(SECRET)
-  })
-
-  it('withholds a result whose run state carries error text without provenance', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
-          unprovenancedErrorText: true,
-        })
-        return Response.json(rowBody)
-      },
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(200)
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
-    expect(trace.getIncompletenessDiagnostics()?.reasons).toEqual([
-      'table-run-state-provenance-unavailable',
-    ])
-  })
-
-  it('keeps a delivered result without run-state error text complete', async () => {
-    const trace = registry()
-    await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
-          unprovenancedErrorText: false,
-        })
-        return Response.json(rowBody)
-      },
-      registry: trace,
-    })(rowUrl)
-
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-  })
-
-  it.each(['GET', 'HEAD'])(
-    'refuses to return a table export download link (%s)',
-    async (method) => {
-      const trace = registry()
-      const inner = vi.fn(async () =>
-        Response.json({ data: { url: 'https://signed.test/export.csv' } })
-      )
-      const response = await createTableReadTransport({
-        endpoint,
-        transport: inner,
-        registry: trace,
-      })(`${endpoint}/api/v2/tables/table/exports/export/download?workspaceId=workspace`, {
-        method,
-      })
-
-      expect(response.status).toBe(403)
-      expect(await response.text()).not.toContain('signed.test')
-      expect(inner).not.toHaveBeenCalled()
-      expect(trace.isPermanentlyIncomplete()).toBe(false)
-    }
-  )
-
-  it('ignores provenance that detached work reports after the call settles', async () => {
-    const trace = registry()
-    let release!: () => void
-    const released = new Promise<void>((resolve) => {
-      release = resolve
-    })
-    let detached: Promise<void> | undefined
-    await createTableReadTransport({
-      endpoint,
-      transport: async () => {
-        detached = released.then(() =>
-          reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
-        )
-        return Response.json({ error: { message: 'Row not found' } }, { status: 404 })
-      },
-      registry: trace,
-    })(rowUrl)
-
-    release()
-    await detached
-    expect(projected(JSON.stringify(rowBody), trace)).toContain(SECRET)
-  })
-
-  it('refuses row reads without a registry instead of returning plaintext', async () => {
-    const inner = vi.fn(deliveringRoute)
-    const response = await createTableReadTransport({ endpoint, transport: inner })(rowUrl)
-
-    expect(response.status).toBe(503)
-    expect(await response.text()).not.toContain(SECRET)
-    expect(inner).not.toHaveBeenCalled()
-  })
-
-  it('keeps a failed row read from poisoning the turn', async () => {
-    const trace = registry()
-    const response = await createTableReadTransport({
-      endpoint,
-      transport: async () =>
-        Response.json({ error: { message: 'Row not found' } }, { status: 404 }),
-      registry: trace,
-    })(rowUrl)
-
-    expect(response.status).toBe(404)
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-  })
-
-  it.each([
-    ['GET', `${endpoint}/api/v2/files/file?workspaceId=workspace`],
-    ['GET', `${endpoint}/api/v2/tables/table?workspaceId=workspace`],
-    ['POST', `${endpoint}/api/v2/tables/table/rows/search`],
-    ['DELETE', `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`],
-    ['GET', 'https://elsewhere.test/api/v2/tables/table/rows/row'],
-  ])('passes %s %s through untouched without a registry', async (method, url) => {
-    const upstream = Response.json({ data: { ok: true } })
-    const inner = vi.fn(async () => upstream)
-    const response = await createTableReadTransport({ endpoint, transport: inner })(url, {
-      method,
-    })
-
-    expect(response).toBe(upstream)
-    expect(inner).toHaveBeenCalledWith(url, { method })
-  })
-
-  it('composes into the sim_cli stack so a table read through the real CLI is redacted', async () => {
-    mocks.scoped.mockImplementation(deliveringRoute)
-    const trace = registry()
-    const result = await executeSimCli(
-      {
-        request: {
-          invocation: {
-            kind: 'cli',
-            argv: ['tables', 'rows', 'get', 'table', 'row'],
-          },
-        },
-      },
-      {
-        userId: 'reader',
-        workspaceId: 'workspace',
-        workflowId: '',
-        chatId: 'chat',
-        resolvedSecretTraceRegistry: trace,
-      }
-    )
-
-    expect(mocks.scoped).toHaveBeenCalled()
-    expect(new URL(String(mocks.scoped.mock.calls[0]?.[0])).pathname).toBe(
-      '/api/v2/tables/table/rows/row'
-    )
-    expect(JSON.stringify(result.output)).toContain(SECRET)
-    expect(trace.isPermanentlyIncomplete()).toBe(false)
-    expect(JSON.stringify(inspectToolResultForCopilot(result, trace, 'sim_cli'))).not.toContain(
-      SECRET
-    )
-  })
-
-  /**
-   * Every v2 table route is either declared row-free or must deliver provenance.
-   * A new route lands in the row-bearing set by default — its results are withheld
-   * until its use case reports delivery — and this list forces that to be a decision.
-   */
-  it('classifies every v2 table route', async () => {
-    const methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
-    const declared = new Set<string>()
-    for (const route of V2_ROUTES) {
-      if (route.pattern !== '/api/v2/tables' && !route.pattern.startsWith('/api/v2/tables/'))
-        continue
-      const module = await route.load()
-      for (const method of methods) {
-        if (typeof Reflect.get(module, method) === 'function')
-          declared.add(`${method} ${route.pattern}`)
-      }
-    }
-
-    expect([...TABLE_ROUTES_WITHOUT_ROW_DATA].filter((key) => !declared.has(key))).toEqual([])
-    expect([...declared].filter((key) => !TABLE_ROUTES_WITHOUT_ROW_DATA.has(key)).sort()).toEqual([
-      'GET /api/v2/tables/{tableId}/exports/{exportId}/download',
-      'GET /api/v2/tables/{tableId}/rows',
-      'GET /api/v2/tables/{tableId}/rows/{rowId}',
-      'GET /api/v2/tables/{tableId}/rows/{rowId}/enrichment/{groupId}',
-      'PATCH /api/v2/tables/{tableId}/rows/{rowId}',
-      'POST /api/v2/tables/{tableId}/query',
-      'POST /api/v2/tables/{tableId}/rows',
-      'POST /api/v2/tables/{tableId}/rows/upsert',
-    ])
-  }, 60_000)
-})
diff --git a/apps/sim/lib/mothership/agent-cli/table-read-transport.ts b/apps/sim/lib/mothership/agent-cli/table-read-transport.ts
deleted file mode 100644
index 2b4090f4fe7..00000000000
--- a/apps/sim/lib/mothership/agent-cli/table-read-transport.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
-
-/**
- * The v2 table routes whose responses carry no cell values, keyed `METHOD pattern`.
- * Every other table route — including one added later — must report the provenance
- * of the rows it returns, or its result is withheld from the model.
- */
-export const TABLE_ROUTES_WITHOUT_ROW_DATA: ReadonlySet<string> = new Set([
-  'GET /api/v2/tables',
-  'POST /api/v2/tables',
-  'POST /api/v2/tables/bulk-delete',
-  'GET /api/v2/tables/folders',
-  'POST /api/v2/tables/folders',
-  'PATCH /api/v2/tables/folders',
-  'DELETE /api/v2/tables/folders',
-  'POST /api/v2/tables/folders/restore',
-  'POST /api/v2/tables/imports',
-  'GET /api/v2/tables/imports/{importId}',
-  'DELETE /api/v2/tables/imports/{importId}',
-  'POST /api/v2/tables/imports/{importId}/complete',
-  'POST /api/v2/tables/imports/{importId}/parts',
-  'POST /api/v2/tables/move',
-  'GET /api/v2/tables/{tableId}',
-  'PATCH /api/v2/tables/{tableId}',
-  'DELETE /api/v2/tables/{tableId}',
-  'POST /api/v2/tables/{tableId}/cancel-runs',
-  'POST /api/v2/tables/{tableId}/columns',
-  'PATCH /api/v2/tables/{tableId}/columns',
-  'DELETE /api/v2/tables/{tableId}/columns',
-  'GET /api/v2/tables/{tableId}/dispatches',
-  'POST /api/v2/tables/{tableId}/dispatches',
-  'GET /api/v2/tables/{tableId}/dispatches/{dispatchId}',
-  'DELETE /api/v2/tables/{tableId}/dispatches/{dispatchId}',
-  'POST /api/v2/tables/{tableId}/exports',
-  'GET /api/v2/tables/{tableId}/exports/{exportId}',
-  'DELETE /api/v2/tables/{tableId}/exports/{exportId}',
-  'GET /api/v2/tables/{tableId}/groups',
-  'POST /api/v2/tables/{tableId}/groups',
-  'PATCH /api/v2/tables/{tableId}/groups',
-  'DELETE /api/v2/tables/{tableId}/groups',
-  'POST /api/v2/tables/{tableId}/query/count',
-  'POST /api/v2/tables/{tableId}/restore',
-  'PATCH /api/v2/tables/{tableId}/rows',
-  'DELETE /api/v2/tables/{tableId}/rows',
-  'DELETE /api/v2/tables/{tableId}/rows/{rowId}',
-  'POST /api/v2/tables/{tableId}/rows/{rowId}/enrichment/{groupId}',
-  'POST /api/v2/tables/{tableId}/rows/bulk-update',
-  'POST /api/v2/tables/{tableId}/rows/search',
-  'GET /api/v2/tables/{tableId}/views',
-  'POST /api/v2/tables/{tableId}/views',
-  'GET /api/v2/tables/{tableId}/views/{viewId}',
-  'PATCH /api/v2/tables/{tableId}/views/{viewId}',
-  'DELETE /api/v2/tables/{tableId}/views/{viewId}',
-])
-
-/**
- * An export download returns a signed link to the whole table as plaintext CSV, which no
- * provenance can follow once fetched, so the link is never returned to the model.
- */
-const TABLE_EXPORT_DOWNLOAD_PATTERN = '/api/v2/tables/{tableId}/exports/{exportId}/download'
-
-/**
- * Row data read through the CLI crosses into the model only with its persisted secret
- * provenance activated in the turn's registry; a row-bearing response that reported no
- * provenance marks the registry incomplete so the result is withheld. So does one whose
- * run state or enrichment detail carries error text: that text is captured from executor
- * output, which can hold resolved secret plaintext, and no provenance is persisted with it.
- */
-export function createTableReadTransport(context: {
-  endpoint: string
-  transport: typeof fetch
-  registry?: ResolvedSecretTraceRegistry
-}): typeof fetch {
-  const base = new URL(context.endpoint)
-  const basePath = base.pathname.replace(/\/$/, '')
-
-  return async (input, init) => {
-    const url = new URL(input instanceof Request ? input.url : input)
-    const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase()
-    const route =
-      url.origin === base.origin && url.pathname.startsWith(`${basePath}/api/v2/tables`)
-        ? matchV2Route(url.pathname.slice(basePath.length))
-        : null
-    if (!route || TABLE_ROUTES_WITHOUT_ROW_DATA.has(`${method} ${route.pattern}`)) {
-      return context.transport(input, init)
-    }
-    if (route.pattern === TABLE_EXPORT_DOWNLOAD_PATTERN) {
-      return Response.json(
-        {
-          error: {
-            message:
-              'Table export download links are not returned to Sim. Download the export from the Tables page.',
-          },
-        },
-        { status: 403 }
-      )
-    }
-    const registry = context.registry
-    if (!registry) {
-      return Response.json(
-        { error: { message: 'Table data cannot be returned to Sim in this context.' } },
-        { status: 503 }
-      )
-    }
-    let delivered = false
-    let unprovenancedErrorText = false
-    let settled = false
-    let response: Response
-    try {
-      response = await observeTableRowDelivery(
-        async (provenance, values, extras) => {
-          if (settled) return
-          delivered = true
-          if (extras.unprovenancedErrorText) unprovenancedErrorText = true
-          await registry.importCrossingProvenance(provenance, values, { trusted: true })
-        },
-        () => context.transport(input, init)
-      )
-    } finally {
-      settled = true
-    }
-    if (response.ok && !delivered) registry.markIncomplete('table-result-provenance-unavailable')
-    if (response.ok && unprovenancedErrorText) {
-      registry.markIncomplete('table-run-state-provenance-unavailable')
-    }
-    return response
-  }
-}
diff --git a/apps/sim/lib/mothership/agent-cli/transport.ts b/apps/sim/lib/mothership/agent-cli/transport.ts
index 06f6a0c88f8..f400833f499 100644
--- a/apps/sim/lib/mothership/agent-cli/transport.ts
+++ b/apps/sim/lib/mothership/agent-cli/transport.ts
@@ -2,19 +2,24 @@ import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-tr
 import { createFileUploadTransport } from '@/lib/mothership/agent-cli/file-upload-transport'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
-import { createTableReadTransport } from '@/lib/mothership/agent-cli/table-read-transport'
 import { createTracedCliTransport } from '@/lib/mothership/agent-cli/traced-transport'
 import type { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import type { CopilotChatDelegationContext } from '@/lib/mothership/auth/application-delegation'
+import {
+  createRegistryContentGate,
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+} from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * The transport every Chat CLI invocation and augmentation engine reaches Sim through.
  *
- * Order is load-bearing: the file read layer sits outside in-process admission so every file
- * read and every other `GET` runs under a delivery observer that records the secret provenance
- * of the bytes, and resource effects observe what the composed stack returns.
+ * Every request, whatever its method, runs under a gate bound to the invocation's registry: each
+ * stored item a use case returns is admitted on its own, its secrets imported for redaction, and a
+ * `sourced` route that classified nothing is refused. Resource effects observe the gated result,
+ * and a workbench copy of delivered bytes keeps the classification of what was admitted.
  */
 export function createAgentCliTransport(context: {
   endpoint: string
@@ -25,19 +30,24 @@ export function createAgentCliTransport(context: {
   observeReads: boolean
 }): typeof fetch {
   const { endpoint, invocation, registry, files } = context
-  const reads = createFileReadTransport({
+  const gate = createRegistryContentGate({
+    registry,
+    workspaceId: invocation.workspaceId,
+    actorUserId: invocation.userId,
+  })
+  const routes = createFileReadTransport({
     endpoint,
-    transport: createTableReadTransport({
-      endpoint,
-      transport: createTracedCliTransport(endpoint, createScopedCliTransport(endpoint, invocation)),
-      registry,
-    }),
-    userId: invocation.userId,
+    transport: createTracedCliTransport(endpoint, createScopedCliTransport(endpoint, invocation)),
     invocation,
     registry,
-    ...(invocation.chatId !== undefined ? { chatId: invocation.chatId } : {}),
-    ...(files ? { trackDownload: files.trackDownload } : {}),
   })
+  const reads: typeof fetch = async (input, init) => {
+    const { response, admitted } = await dispatchUnderContentGate(gate, () => routes(input, init))
+    if (files && admitted.length > 0 && response.body) {
+      files.trackDownload(response.body, deliveredFileProvenance(admitted))
+    }
+    return response
+  }
   return createResourceEffectTransport(
     endpoint,
     files
diff --git a/apps/sim/lib/mothership/agent-cli/types.ts b/apps/sim/lib/mothership/agent-cli/types.ts
index f20c60d9f2e..a210e7042be 100644
--- a/apps/sim/lib/mothership/agent-cli/types.ts
+++ b/apps/sim/lib/mothership/agent-cli/types.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import type { CopilotChatDelegationContext } from '@/lib/mothership/auth/application-delegation'
 import type { AgentCliRawResult } from '@/lib/mothership/generated/agent-cli'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 /**
  * Sim's half of the mothership↔CLI translation layer: generic execution PRIMITIVES.
  * The worker owns the grammar (what commands exist, how argv parses, pipes, help, the
@@ -36,6 +37,11 @@ export interface AgentCliRuntime {
   /** The human the command acts as — reference resolution and grants scope to them. */
   userId: string
   chatId?: string
+  /**
+   * The invocation's secret provenance, which model egress redacts the result with. Egress
+   * matches whole secrets, so an engine that clips or splits text it read redacts it here first.
+   */
+  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
   signal?: AbortSignal
 }
 
diff --git a/apps/sim/lib/mothership/application/application-adapter.test.ts b/apps/sim/lib/mothership/application/application-adapter.test.ts
index 9e02fe214e0..e96924714a8 100644
--- a/apps/sim/lib/mothership/application/application-adapter.test.ts
+++ b/apps/sim/lib/mothership/application/application-adapter.test.ts
@@ -11,6 +11,7 @@ import {
 
 const operation = defineWorkspaceOperation({
   id: 'files.read',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   principalKinds: ['delegated'],
@@ -81,6 +82,7 @@ describe('Copilot application adapter', () => {
     const executeCopilotUseCase = createAdapter()
     const unregistered = defineWorkspaceOperation({
       id: 'files.unregistered',
+      contentDelivery: 'none',
       minimumRole: 'read',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
@@ -89,6 +91,7 @@ describe('Copilot application adapter', () => {
     })
     const sameIdDifferentPolicy = defineWorkspaceOperation({
       id: operation.id,
+      contentDelivery: 'none',
       minimumRole: 'write',
       workspaceApiKey: 'deny',
       principalKinds: ['delegated'],
diff --git a/apps/sim/lib/mothership/application/operations.ts b/apps/sim/lib/mothership/application/operations.ts
index 7051af5b838..549f8e39ff7 100644
--- a/apps/sim/lib/mothership/application/operations.ts
+++ b/apps/sim/lib/mothership/application/operations.ts
@@ -12,6 +12,7 @@ export const chatOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -23,6 +24,7 @@ export const chatOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/mothership/application/workspace-target.ts b/apps/sim/lib/mothership/application/workspace-target.ts
index d5066882b6a..ae3f9fb5520 100644
--- a/apps/sim/lib/mothership/application/workspace-target.ts
+++ b/apps/sim/lib/mothership/application/workspace-target.ts
@@ -68,6 +68,7 @@ const headlessTargetOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
index c6f11fba754..1ee718997ee 100644
--- a/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
+++ b/apps/sim/lib/mothership/chat/application/authorized-chat-use-case.ts
@@ -4,6 +4,7 @@ import {
   defineAuthorizedWorkspaceUseCase,
   type PrincipalForOperation,
   requireAllowedWorkspacePrincipal,
+  runDeclaredContentOperation,
   type WorkspaceAuthorizationContext,
   type WorkspaceAuthorizationOptions,
   type WorkspaceOperation,
@@ -128,11 +129,16 @@ export function defineAuthorizedChatUseCase<
           request,
         })
       const execution = { principal: resolved.principal, input, context: resolved.context, request }
-      return runWithOutboundOrganization(resolved.organizationId, async () => {
-        const result = await definition.execute(execution)
-        await definition.afterSuccess?.({ ...execution, result })
-        return result
-      })
+      return runWithOutboundOrganization(resolved.organizationId, () =>
+        runDeclaredContentOperation(
+          definition.operation,
+          resolved.principal,
+          () => definition.execute(execution),
+          async (result) => {
+            await definition.afterSuccess?.({ ...execution, result })
+          }
+        )
+      )
     },
   }
 }
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.test.ts b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
index b004fee8a2d..c2bdbd0d6f6 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.test.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.test.ts
@@ -40,6 +40,7 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-artifact', () =>
 }))
 vi.mock('@/lib/execution/remote-sandbox', () => remoteSandboxMock)
 
+import { admitContent, ContentRefusedError, requireAdmittedContent } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   materializeInlineChatImage,
@@ -71,6 +72,20 @@ function ownChat() {
   queueTableRows(copilotChats, [owner])
 }
 const missing = () => Object.assign(new Error('missing'), { code: 'ENOENT' })
+/** Stands in for a source read that classifies the clean image it returns, as the real reads do. */
+function admittedRead(buffer: Buffer) {
+  return async ({ principal }: { principal: Principal }) => {
+    await admitContent(principal, [
+      {
+        kind: 'workspace-file',
+        id: 'image',
+        provenance: { status: 'exact', entries: [] },
+        view: 'opaque',
+      },
+    ])
+    return { buffer }
+  }
+}
 async function raster() {
   return sharp({ create: { width: 4, height: 3, channels: 3, background: '#ee2244' } })
     .png()
@@ -183,7 +198,7 @@ describe('private chat image application boundary', () => {
   )
   it('accepts the existing chat-scoped Copilot file delegation', async () => {
     ownChat()
-    mocks.artifact.mockResolvedValue({ buffer: await raster() })
+    mocks.artifact.mockImplementation(admittedRead(await raster()))
     await materializeStreamImage(
       { userId: 'owner', workspaceId: 'workspace', chatId: 'chat' },
       input
@@ -195,6 +210,26 @@ describe('private chat image application boundary', () => {
       resourceScope: { chatId: 'chat' },
     })
   })
+  it('refuses to stream an image whose source holds a recorded secret', async () => {
+    ownChat()
+    const buffer = await raster()
+    mocks.artifact.mockImplementation(async ({ principal }: { principal: Principal }) => {
+      await requireAdmittedContent(principal, {
+        kind: 'workspace-file',
+        id: 'image',
+        provenance: {
+          status: 'exact',
+          entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'owner' }],
+        },
+        view: 'opaque',
+      })
+      return { buffer }
+    })
+    await expect(
+      materializeStreamImage({ userId: 'owner', workspaceId: 'workspace', chatId: 'chat' }, input)
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
   it('refuses decoder failure without upload', async () => {
     ownChat()
     mocks.artifact.mockResolvedValue({ buffer: Buffer.from('broken') })
@@ -274,7 +309,7 @@ describe('organization inline images', () => {
   }
   it('publishes scratch using the org chat delegation with no default workspace', async () => {
     ownOrgChat()
-    mocks.scratch.mockResolvedValue({ buffer: await raster() })
+    mocks.scratch.mockImplementation(admittedRead(await raster()))
     await materializeStreamImage(
       { userId: 'owner', organizationId: 'org', chatId: 'chat' },
       { ...input, reference: '/tmp/chart.png' }
diff --git a/apps/sim/lib/mothership/chat/application/inline-images.ts b/apps/sim/lib/mothership/chat/application/inline-images.ts
index 13bae0da512..a65f5cdea6b 100644
--- a/apps/sim/lib/mothership/chat/application/inline-images.ts
+++ b/apps/sim/lib/mothership/chat/application/inline-images.ts
@@ -1,5 +1,9 @@
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
+import {
+  admitContent,
+  defineWorkspaceOperation,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
@@ -23,6 +27,7 @@ import {
   normalizeInlineChatImage,
   storeInlineChatImage,
 } from '@/lib/mothership/chat/inline-image-storage'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { loadActiveWorkspaceFileContext } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { MAX_TEXT_EXTRACTION_BYTES } from '@/lib/uploads/utils/file-utils'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
@@ -83,11 +88,13 @@ export const materializeInlineChatImage = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'personal_api_key', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.publish_image',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
@@ -107,6 +114,11 @@ export const materializeInlineChatImage = defineAuthorizedChatUseCase({
   },
   async execute({ principal, context, input, request }) {
     validateImageInput(input)
+    /**
+     * The result is a URL. The source read below admits its own bytes; a snapshot already
+     * published was admitted when it was published.
+     */
+    await admitContent(principal, [])
     const signal = input.signal ?? request?.signal
     signal?.throwIfAborted()
     const url = inlineChatImageUrl(context.chatId, input.requestId, input.reference)
@@ -190,24 +202,35 @@ export function materializeStreamImage(
   ),
   input: { requestId: string; reference: string; signal?: AbortSignal }
 ) {
-  return materializeInlineChatImage.execute({
-    principal: context.organizationId
-      ? createTrustedOrganizationCopilotPrincipal(
-          {
-            ...context,
-            organizationId: context.organizationId,
-            delegationId: `chat-image:${context.chatId}`,
-          },
-          {
-            audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
-            ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
-          }
-        )
-      : createCopilotChatFilePrincipal({
-          userId: context.userId,
-          chatId: context.chatId,
-          workspaceId: context.workspaceId!,
-        }),
-    input: { ...input, chatId: context.chatId },
+  /**
+   * A streamed image is opaque: no redaction reaches its pixels, so the gate admits only a clean
+   * or unrecorded source and refuses one holding a recorded secret, whatever registry exists.
+   */
+  const gate = createRegistryContentGate({
+    workspaceId: context.workspaceId,
+    organizationId: context.organizationId,
+    actorUserId: context.userId,
   })
+  return observeContentDelivery(gate, () =>
+    materializeInlineChatImage.execute({
+      principal: context.organizationId
+        ? createTrustedOrganizationCopilotPrincipal(
+            {
+              ...context,
+              organizationId: context.organizationId,
+              delegationId: `chat-image:${context.chatId}`,
+            },
+            {
+              audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
+              ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
+            }
+          )
+        : createCopilotChatFilePrincipal({
+            userId: context.userId,
+            chatId: context.chatId,
+            workspaceId: context.workspaceId!,
+          }),
+      input: { ...input, chatId: context.chatId },
+    })
+  )
 }
diff --git a/apps/sim/lib/mothership/chat/application/operations.ts b/apps/sim/lib/mothership/chat/application/operations.ts
index 83a08459cee..09ee33d006c 100644
--- a/apps/sim/lib/mothership/chat/application/operations.ts
+++ b/apps/sim/lib/mothership/chat/application/operations.ts
@@ -16,6 +16,7 @@ export const mothershipChatOperations = {
     id: 'mothership.chats.list',
     ...workspacePolicy,
     capability: 'none',
+    contentDelivery: 'none',
   }),
   restore: Object.freeze({
     // permission-group-exempt: restoring and listing a user's own chats preserves workspace access policy.
@@ -23,10 +24,12 @@ export const mothershipChatOperations = {
       id: 'mothership.chats.restore',
       ...workspacePolicy,
       capability: 'none',
+      contentDelivery: 'none',
     }),
     // permission-group-exempt: restoring and listing a user's own chats preserves workspace access policy.
     organizationOperation: defineOrganizationOperation({
       id: 'mothership.chats.restore',
+      contentDelivery: 'none',
       minimumRole: 'member',
       principalKinds: ['session', 'organization_delegated'],
       delegationAudience: 'sim:settings',
diff --git a/apps/sim/lib/mothership/chat/application/read-attachment.ts b/apps/sim/lib/mothership/chat/application/read-attachment.ts
index 73b4d0e5580..f53e65d7883 100644
--- a/apps/sim/lib/mothership/chat/application/read-attachment.ts
+++ b/apps/sim/lib/mothership/chat/application/read-attachment.ts
@@ -1,7 +1,8 @@
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
+import { defineWorkspaceOperation, requireAdmittedContent } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
 import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
 import { loadChatFileAttachmentsNamed } from '@/lib/mothership/chat/lifecycle'
@@ -15,11 +16,13 @@ export const readChatAttachment = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.read_attachment',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'organization_delegated'],
@@ -64,6 +67,13 @@ export const readChatAttachment = defineAuthorizedChatUseCase({
       )
     const file = matches.values().next().value
     if (!file) throw new OrchestrationError('not_found', 'Chat attachment not found')
+    /** A member's own upload to this chat carries no secret Sim resolved into it. */
+    await requireAdmittedContent(principal, {
+      kind: 'workspace-file',
+      id: file.id,
+      provenance: EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
+      view: 'complete',
+    })
     return readOrganizationChatAttachment({
       principal,
       organizationId: context.organizationId,
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
index 98bd6590cee..1afb2bd1acf 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.test.ts
@@ -6,7 +6,9 @@ import {
 } from '@sim/testing/factories/principal.factory'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { ContentRefusedError, observeContentDelivery } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 
 const hoisted = vi.hoisted(() => ({
   context: vi.fn(),
@@ -39,6 +41,19 @@ const mocks = {
 }
 
 const principal: Principal = createSessionPrincipal({ userId: 'u', sessionId: 's' })
+const chatPrincipal = createCopilotChatFilePrincipal({
+  userId: 'u',
+  workspaceId: 'ws',
+  chatId: 'chat',
+})
+
+/** Chat's reads run under the gate its transport installs; no registry, so secrets are refused. */
+function readAsChat(scope: { principal?: Principal } = {}) {
+  return observeContentDelivery(
+    createRegistryContentGate({ workspaceId: 'ws', actorUserId: 'u' }),
+    () => readChatSandboxFile.execute({ principal: scope.principal ?? chatPrincipal, input })
+  )
+}
 const input = { workspaceId: 'ws', chatId: 'chat', path: '/tmp/image.png' }
 const machine = { providerId: 'e2b', sandboxId: 'physical' }
 beforeEach(() => {
@@ -73,6 +88,7 @@ describe('owned scratch snapshot reads', () => {
       buffer: Buffer.from('png'),
       name: 'image.png',
       path: input.path,
+      hasRecordedSecrets: false,
     })
     expect(mocks.context).toHaveBeenCalledWith(principal, 'chat')
     expect(mocks.snapshot).toHaveBeenCalledWith(
@@ -97,12 +113,23 @@ describe('owned scratch snapshot reads', () => {
   it.each([
     { status: 'unknown' },
     { status: 'exact', entries: [{ encryptedValue: 'secret', sourceUserId: 'u' }] },
-  ])('refuses explicit unknown or secret-bearing opaque file provenance: %j', async (receipt) => {
-    mocks.receipt.mockReturnValue(receipt)
-    await expect(readChatSandboxFile.execute({ principal, input })).rejects.toThrow(
-      'no verified secret-free provenance'
-    )
-    expect(mocks.dispose).toHaveBeenCalledOnce()
+  ])(
+    'refuses Chat explicit unknown or unredactable secret-bearing provenance: %j',
+    async (receipt) => {
+      mocks.receipt.mockReturnValue(receipt)
+      await expect(readAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mocks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+  it('serves the user their own scratch file whatever its provenance, flagging recorded secrets', async () => {
+    mocks.receipt.mockReturnValue({
+      status: 'exact',
+      entries: [{ encryptedValue: 'secret', sourceUserId: 'u' }],
+    })
+    expect(await readChatSandboxFile.execute({ principal, input })).toMatchObject({
+      name: 'image.png',
+      hasRecordedSecrets: true,
+    })
   })
   it('enforces size before streaming and still disposes the snapshot', async () => {
     await expect(
@@ -128,14 +155,7 @@ describe('owned scratch snapshot reads', () => {
 
 describe('scoped chat file delegation', () => {
   it('accepts the canonical owned chat principal without minting an API key', async () => {
-    const delegated = createCopilotChatFilePrincipal({
-      userId: 'u',
-      workspaceId: 'ws',
-      chatId: 'chat',
-    })
-    expect((await readChatSandboxFile.execute({ principal: delegated, input })).name).toBe(
-      'image.png'
-    )
+    expect((await readAsChat()).name).toBe('image.png')
   })
   it.each(['chat', 'audience', 'expired', 'file'])(
     'denies wrong %s delegation before sandbox access',
@@ -173,9 +193,7 @@ it('rejects a workspace API key before canonical lookup or sandbox access', asyn
   expect(mocks.snapshot).not.toHaveBeenCalled()
 })
 
-it('permits a source explicitly classified as unrecorded', async () => {
+it('permits Chat a source explicitly classified as unrecorded', async () => {
   mocks.receipt.mockReturnValue({ status: 'unrecorded' })
-  expect((await readChatSandboxFile.execute({ principal, input })).buffer).toEqual(
-    Buffer.from('png')
-  )
+  expect((await readAsChat()).buffer).toEqual(Buffer.from('png'))
 })
diff --git a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
index cd5b9fe8543..65c89afc53a 100644
--- a/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
+++ b/apps/sim/lib/mothership/chat/application/read-sandbox-file.ts
@@ -1,10 +1,9 @@
 import { posix } from 'node:path'
 import type { Principal } from '@sim/auth/principal'
-import { defineWorkspaceOperation } from '@/lib/core/application'
+import { defineWorkspaceOperation, requireAdmittedContent } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { readStreamToBufferWithLimit } from '@/lib/core/utils/stream-limits'
-import { reportDurableSecretProvenanceUnrecorded } from '@/lib/execution/durable-secret-provenance-telemetry'
 import { openSessionFileSnapshot } from '@/lib/execution/remote-sandbox/session-file-snapshot'
 import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
@@ -43,11 +42,13 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'copilot.use',
+    contentDelivery: 'sourced',
     principalKinds: ['session', 'personal_api_key', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   organizationOperation: defineOrganizationOperation({
     id: 'mothership.chats.read_sandbox_file',
+    contentDelivery: 'sourced',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
@@ -77,7 +78,7 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
         principal.resourceScope?.fileId === undefined,
     },
   },
-  async execute({ context, input }) {
+  async execute({ context, input, principal }) {
     const path = normalizeScratchPath(input.path)
     const maxBytes = input.maxBytes ?? MAX_TEXT_EXTRACTION_BYTES
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_TEXT_EXTRACTION_BYTES) {
@@ -111,25 +112,20 @@ export const readChatSandboxFile = defineAuthorizedChatUseCase({
       })
       input.signal?.throwIfAborted()
       const receipt = provenance.uploadProvenance()
-      if (
-        receipt.status === 'unknown' ||
-        (receipt.status === 'exact' && receipt.entries.length > 0)
-      ) {
-        throw new OrchestrationError(
-          'forbidden',
-          'This scratch file has no verified secret-free provenance. Read a verified source or regenerate it in a fresh workbench.'
-        )
-      }
+      await requireAdmittedContent(principal, {
+        kind: 'workspace-file',
+        id: path,
+        provenance: receipt,
+        view: 'complete',
+      })
       input.signal?.throwIfAborted()
-      if (receipt.status === 'unrecorded') {
-        reportDurableSecretProvenanceUnrecorded({
-          surface: 'workspace-file',
-          workspaceId: context.workspaceId,
-          organizationId: context.organizationId,
-          actorUserId: context.userId,
-        })
+      return {
+        buffer,
+        path,
+        name: posix.basename(path),
+        /** A visual of these bytes would show what text redaction hides. */
+        hasRecordedSecrets: receipt.status === 'exact' && receipt.entries.length > 0,
       }
-      return { buffer, path, name: posix.basename(path) }
     } finally {
       await snapshot.dispose()
     }
diff --git a/apps/sim/lib/mothership/chat/application/workspace-context.ts b/apps/sim/lib/mothership/chat/application/workspace-context.ts
index 9f8cb686405..035b27a48e6 100644
--- a/apps/sim/lib/mothership/chat/application/workspace-context.ts
+++ b/apps/sim/lib/mothership/chat/application/workspace-context.ts
@@ -12,6 +12,7 @@ export const readWorkspaceContextOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
@@ -20,6 +21,7 @@ export const readWorkspaceContext = defineAuthorizedChatUseCase({
   operation: readWorkspaceContextOperation,
   organizationOperation: defineOrganizationOperation({
     id: readWorkspaceContextOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/chat/application/workspace-target.ts b/apps/sim/lib/mothership/chat/application/workspace-target.ts
index 3f809156a22..4699f9eef99 100644
--- a/apps/sim/lib/mothership/chat/application/workspace-target.ts
+++ b/apps/sim/lib/mothership/chat/application/workspace-target.ts
@@ -14,6 +14,7 @@ const targetOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['session', 'personal_api_key', 'delegated'],
   delegatedServices: ['copilot'],
 })
@@ -23,6 +24,7 @@ export const authorizeChatWorkspaceTarget = defineAuthorizedChatUseCase({
   operation: targetOperation,
   organizationOperation: defineOrganizationOperation({
     id: targetOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'personal_api_key', 'organization_delegated'],
diff --git a/apps/sim/lib/mothership/chat/organization-chats.ts b/apps/sim/lib/mothership/chat/organization-chats.ts
index d0fc8d50251..33007ef3755 100644
--- a/apps/sim/lib/mothership/chat/organization-chats.ts
+++ b/apps/sim/lib/mothership/chat/organization-chats.ts
@@ -31,6 +31,7 @@ export const organizationChatOperations = {
   }),
   list: defineOrganizationOperation({
     id: 'organization.chats.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -160,6 +161,7 @@ export const organizationChatDelegationOperations = {
    */
   cancel: defineOrganizationOperation({
     id: 'organization.chats.cancel',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     capability: 'none',
@@ -168,6 +170,7 @@ export const organizationChatDelegationOperations = {
   }),
   settings: defineOrganizationOperation({
     id: 'organization.chats.settings',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -176,6 +179,7 @@ export const organizationChatDelegationOperations = {
   }),
   workspaces: defineOrganizationOperation({
     id: 'organization.chats.workspaces',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -184,6 +188,7 @@ export const organizationChatDelegationOperations = {
   }),
   knowledge: defineOrganizationOperation({
     id: 'organization.chats.knowledge',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -192,6 +197,7 @@ export const organizationChatDelegationOperations = {
   }),
   secrets: defineOrganizationOperation({
     id: 'organization.chats.secrets',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
@@ -200,6 +206,7 @@ export const organizationChatDelegationOperations = {
   }),
   billing: defineOrganizationOperation({
     id: 'organization.chats.admit',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     capability: 'copilot.use',
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 6694ec63841..aa2a33fa9b4 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -1,4 +1,6 @@
+import type { Principal } from '@sim/auth/principal'
 import { dbChainMockFns, workflowAuthzMockFns } from '@sim/testing'
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import {
   integrationsAvailabilityMock,
   integrationsAvailabilityMockFns,
@@ -35,7 +37,7 @@ import {
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
-import { DelegatedWorkspaceAuthorizationError } from '@/lib/core/application'
+import { admitContent, DelegatedWorkspaceAuthorizationError } from '@/lib/core/application'
 import {
   MAX_TABLE_SELECTION_PREVIEW_LENGTH,
   MAX_TABLE_SELECTION_ROWS,
@@ -79,11 +81,15 @@ const {
   readWorkspaceFileMetadata: vi.fn(),
   readTableView: vi.fn(),
   readWorkflowMetadata: vi.fn(),
-  listWorkflowFolders: vi.fn(
-    async (): Promise<{ folders: { id: string; name: string; parentId: string | null }[] }> => ({
-      folders: [],
-    })
-  ),
+  listWorkflowFolders: vi.fn<
+    (
+      request: Parameters<
+        typeof import('@/lib/workflows/application/workflow-folders').listWorkflowFolders.execute
+      >[0]
+    ) => Promise<{ folders: { id: string; name: string; parentId: string | null }[] }>
+  >(async () => ({
+    folders: [],
+  })),
   listTableFolders: vi.fn(
     async (): Promise<{ folders: { id: string; name: string; parentId: string | null }[] }> => ({
       folders: [],
@@ -118,6 +124,7 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () =>
   readWorkspaceFileMetadata: { execute: readWorkspaceFileMetadata },
 }))
 vi.mock('@/lib/table/application/rows', () => tableApplicationRowsMock)
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/table/application/views', () => ({
   readTableViewUseCase: { execute: readTableView },
 }))
@@ -473,8 +480,8 @@ describe('processContextsServer - docs contexts', () => {
     const result = await processContextsServer(
       [
         { kind: 'docs', label: 'Product docs' },
-        { kind: 'blocks', label: 'Read [rows]' },
-        { kind: 'integration', label: 'My service' },
+        { kind: 'blocks', blockIds: [], label: 'Read [rows]' },
+        { kind: 'integration', blockType: 'custom_api', label: 'My service' },
       ],
       'reader',
       '@Product docs compare @Read [rows] with @My service and @unknown',
@@ -1149,7 +1156,6 @@ describe('processContextsServer - table_selection contexts', () => {
         legacyKeying: 'ids',
         columns: ['c_name', 'c_amount'],
         limit: 2,
-        includeTotal: true,
       },
     })
     expect(result).toHaveLength(1)
@@ -1400,7 +1406,15 @@ describe('processContextsServer - table_selection contexts', () => {
       nextCursor: 'next-page',
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1409,6 +1423,35 @@ describe('processContextsServer - table_selection contexts', () => {
     expect(context.content).toContain('| r1 | Ada |')
   })
 
+  it('notes rows it did not show without saying why, inside the preview limit', async () => {
+    readTableUseCase.mockResolvedValue({
+      table: { name: 'Sales', schema: { columns: [{ id: 'name', name: 'Name' }] } },
+      folderPath: '/',
+    })
+    queryTableRows.mockResolvedValue({
+      rows: [{ id: 'r1', data: { name: 'Ada' } }],
+      totalCount: null,
+      nextCursor: null,
+    })
+    const [context] = await processContextsServer(
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2'],
+        },
+      ],
+      'user-1',
+      '',
+      'ws-1'
+    )
+    expect(context.content).toContain('1 selected row is not shown')
+    expect(context.content).not.toContain('r2')
+    expect(context.content).toContain('| r1 | Ada |')
+  })
+
   it('deduplicates row IDs and preserves selection order independently of query order', async () => {
     readTableUseCase.mockResolvedValue({
       table: { name: 'Sales', schema: { columns: [{ id: 'name', name: 'Name' }] } },
@@ -1422,7 +1465,15 @@ describe('processContextsServer - table_selection contexts', () => {
       totalCount: 2,
     })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1', 'r2', 'r1'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1', 'r2', 'r1'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -1438,6 +1489,7 @@ describe('processContextsServer - table_selection contexts', () => {
         {
           kind: 'table_selection',
           tableId: 'tbl-1',
+          tableName: 'Sales',
           label: 'Rows',
           rowIds: Array.from({ length: MAX_TABLE_SELECTION_ROWS + 1 }, (_, i) => `r${i}`),
         },
@@ -1451,6 +1503,55 @@ describe('processContextsServer - table_selection contexts', () => {
     expect(queryTableRows).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['a pipe', 'tok|en-FIXTURE-PIPE-0001'],
+    ['a newline', 'tok\nen-FIXTURE-LINE-0002'],
+  ])('redacts a cell secret holding %s before markdown escaping', async (_case, secret) => {
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => ({
+      decrypted: value.slice('enc:'.length),
+    }))
+    readTableUseCase.mockResolvedValue({
+      table: { name: 'Keys', schema: { columns: [{ id: 'c_key', name: 'Key' }] } },
+      folderPath: '/',
+    })
+    const rows = [{ id: 'r1', data: { c_key: `value ${secret}` } }]
+    /** The real query admits each row it returns; this one carries the secret's provenance. */
+    queryTableRows.mockImplementation(async ({ principal }) => {
+      await admitContent(principal, [
+        {
+          kind: 'table-row',
+          id: 'r1',
+          provenance: {
+            status: 'exact',
+            entries: [
+              { name: 'CELL_TOKEN', encryptedValue: `enc:${secret}`, sourceUserId: 'user-1' },
+            ],
+          },
+          view: { derived: rows[0].data },
+        },
+      ])
+      return { rows, totalCount: 1 }
+    })
+    const [context] = await processContextsServer(
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Keys',
+          label: 'Keys',
+          rowIds: ['r1'],
+        },
+      ],
+      'user-1',
+      '',
+      'ws-1'
+    )
+    expect(context.content).toContain('[REDACTED_SECRET]')
+    for (const fragment of [secret.slice(0, 4), secret.slice(-4), ...secret.split(/[|\n]/)]) {
+      expect(context.content).not.toContain(fragment)
+    }
+  })
+
   it('keeps oversized column headings within the selection budget', async () => {
     readTableUseCase.mockResolvedValue({
       table: {
@@ -1466,7 +1567,15 @@ describe('processContextsServer - table_selection contexts', () => {
     })
     queryTableRows.mockResolvedValue({ rows: [{ id: 'r1', data: {} }], totalCount: 1 })
     const [context] = await processContextsServer(
-      [{ kind: 'table_selection', tableId: 'tbl-1', label: 'Rows', rowIds: ['r1'] }],
+      [
+        {
+          kind: 'table_selection',
+          tableId: 'tbl-1',
+          tableName: 'Sales',
+          label: 'Rows',
+          rowIds: ['r1'],
+        },
+      ],
       'user-1',
       '',
       'ws-1'
@@ -2011,15 +2120,16 @@ describe('organization resource mention targets', () => {
    * yields no context.
    */
   const ownedBy =
-    (workspaceId: string, value: unknown) =>
+    <T>(workspaceId: string, value: T) =>
     async ({
       principal,
       input,
     }: {
-      principal: { workspaceId?: string }
+      principal: Principal
       input: { workspaceId?: string; assertedWorkspaceId?: string }
     }) => {
       if (
+        !('workspaceId' in principal) ||
         principal.workspaceId !== workspaceId ||
         (input.workspaceId ?? input.assertedWorkspaceId) !== workspaceId
       ) {
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index 18d7a4fd78c..047d571b2b6 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -8,6 +8,7 @@ import {
 import { escapeRegExp } from '@sim/utils/string'
 import { eq } from 'drizzle-orm'
 import type { MothershipTableViewContext } from '@/lib/api/contracts/mothership-resources'
+import { observeContentDelivery } from '@/lib/core/application'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
@@ -51,6 +52,7 @@ import {
   truncateSelectionText,
 } from '@/lib/mothership/chat/selection-context'
 import { quoteChatTranscript } from '@/lib/mothership/chat/text-transcript'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { QueryLogs } from '@/lib/mothership/generated/tool-catalog-v1'
 import { canonicalWorkspaceFilePath } from '@/lib/mothership/vfs/path-utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
@@ -71,7 +73,8 @@ import { readWorkflowMetadata } from '@/lib/workflows/application/read-workflow'
 import { getBuiltinSkillById } from '@/lib/workflows/skills/builtin-skills'
 import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import { getBlockRegistry } from '@/blocks/registry'
-import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import type { BrowserTextSelection, ChatContext, TerminalTextSelection } from '@/stores/panel'
 
 type AgentContextType =
@@ -346,7 +349,8 @@ export async function processContextsServer(
         ctx.columnIds,
         ctx.label,
         userId,
-        chatId
+        chatId,
+        resolvedSecretTraceRegistry
       )
     }
     if ((ctx.kind === 'folder' || ctx.kind === 'filefolder') && workspaceId) {
@@ -1126,7 +1130,8 @@ async function resolveTableSelectionResource(
   columnIds: string[] | undefined,
   label: string,
   userId: string,
-  chatId?: string
+  chatId?: string,
+  turnRegistry?: ResolvedSecretTraceRegistry
 ): Promise<AgentContext | null> {
   if (
     rowIds.length > MAX_TABLE_SELECTION_ROWS ||
@@ -1153,17 +1158,30 @@ async function resolveTableSelectionResource(
   if (columns.length === 0) return null
 
   const uniqueRowIds = [...new Set(rowIds)]
-  const result = await queryTableRows.execute({
-    principal,
-    input: {
-      tableId,
-      assertedWorkspaceId: workspaceId,
-      predicate: { all: [{ field: 'id', op: 'in', value: uniqueRowIds }] },
-      legacyKeying: 'ids',
-      columns: columns.map(getColumnId),
-      limit: uniqueRowIds.length,
-      includeTotal: true,
-    },
+  /**
+   * The preview is inlined into the turn as text no later projection reads, so it is redacted
+   * here: each row is admitted on its own against a selection-local registry, which then redacts
+   * the preview and hands its secrets to the turn's registry for everything after.
+   */
+  const selectionRegistry = new ResolvedSecretTraceRegistry([], { userId, workspaceId })
+  const result = await observeContentDelivery(
+    createRegistryContentGate({ registry: selectionRegistry, workspaceId, actorUserId: userId }),
+    () =>
+      queryTableRows.execute({
+        principal,
+        input: {
+          tableId,
+          assertedWorkspaceId: workspaceId,
+          predicate: { all: [{ field: 'id', op: 'in', value: uniqueRowIds }] },
+          legacyKeying: 'ids',
+          columns: columns.map(getColumnId),
+          limit: uniqueRowIds.length,
+        },
+      })
+  )
+  await turnRegistry?.importProvenance(selectionRegistry.exportProvenance(), {
+    trusted: true,
+    origin: 'chatContext.tableSelection',
   })
   const rowsById = new Map(result.rows.map((row) => [row.id, row]))
   const rows = uniqueRowIds.flatMap((id) => {
@@ -1171,7 +1189,14 @@ async function resolveTableSelectionResource(
     return row ? [row] : []
   })
   if (rows.length === 0) return null
-  const selectedRowCount = result.totalCount ?? rows.length
+  /**
+   * A byte-limited page still has the rest of the selection to read, so those rows count as
+   * omitted for length. Otherwise a missing row was deleted or withheld; the note says so without
+   * telling which.
+   */
+  const missingRows = uniqueRowIds.length - rows.length
+  const pageLimited = result.nextCursor !== null && result.nextCursor !== undefined
+  const selectedRowCount = rows.length + (pageLimited ? missingRows : 0)
 
   const selection = JSON.stringify({
     tableId,
@@ -1202,23 +1227,63 @@ async function resolveTableSelectionResource(
   // needs. The real clause isn't known until packing finishes, so reserve its
   // longest form: every row shown AND every row omitted maximizes both counts
   // and forces the plural. A few characters of unused slack beats overshooting.
+  /**
+   * Each cell is redacted as stored, before markdown escaping rewrites `|` and newlines: redaction
+   * matches a secret's exact text, so escaping first would let a secret holding either pass.
+   */
+  let cellsProjected = true
+  const projectCell = (value: unknown): string => {
+    if (value === null || value === undefined) return ''
+    const projection = projectResolvedSecretModelContent(
+      typeof value === 'string' ? value : JSON.stringify(value),
+      selectionRegistry
+    )
+    if (projection.safe && typeof projection.value === 'string') return projection.value
+    cellsProjected = false
+    return ''
+  }
+  const omittedRows = pageLimited ? 0 : missingRows
+  const omittedNote =
+    omittedRows > 0
+      ? `\n\n${omittedRows} selected ${omittedRows === 1 ? 'row is' : 'rows are'} not shown: deleted since the selection, or not available to Chat.`
+      : ''
   const lines: string[] = []
   let remaining =
     MAX_TABLE_SELECTION_PREVIEW_LENGTH -
-    describe(sizeClause(selectedRowCount, selectedRowCount)).length
+    describe(sizeClause(selectedRowCount, selectedRowCount)).length -
+    omittedNote.length
   for (const row of rows) {
-    const line = `| ${renderTableCell(row.id)} | ${columns.map((col) => renderTableCell(row.data[getColumnId(col)])).join(' | ')} |`
+    const line = `| ${renderTableCell(row.id)} | ${columns.map((col) => renderTableCell(projectCell(row.data[getColumnId(col)]))).join(' | ')} |`
     if (line.length + 1 > remaining) break
     lines.push(line)
     remaining -= line.length + 1
   }
 
   const rendered = `${describe(sizeClause(lines.length, selectedRowCount - lines.length))}${lines.join('\n')}`
+  const projected = projectResolvedSecretModelContent(rendered, selectionRegistry)
+  /** A fallback names the table, which is redacted like the rest; unredactable, it is omitted. */
+  const fallback = (reason: string) => {
+    const named = `Selected ${scope} from table ${JSON.stringify(table.name)} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+    const projectedName = projectResolvedSecretModelContent(named, selectionRegistry)
+    return projectedName.safe && typeof projectedName.value === 'string'
+      ? projectedName.value
+      : `Selected ${scope} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+  }
   const preview =
-    rendered.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
-      ? rendered
-      : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
-  const content = `${selection}\n\n${preview}`
+    !cellsProjected || !projected.safe || typeof projected.value !== 'string'
+      ? fallback('Cell values could not be checked for secret values, so none were inlined.')
+      : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
+        ? `${projected.value}${omittedNote}`
+        : fallback(
+            'The column headings exceed the selection content limit; no cell values were inlined.'
+          )
+  /** The descriptor names columns and rows; it is shown to the model too, so it is redacted too. */
+  const projectedSelection = projectResolvedSecretModelContent(selection, selectionRegistry)
+  const descriptor =
+    projectedSelection.safe && typeof projectedSelection.value === 'string'
+      ? projectedSelection.value
+      : JSON.stringify({ tableId })
+  const content = `${descriptor}\n\n${preview}`
   return {
     type: 'table_selection',
     tag: label ? `@${label}` : '@',
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.test.ts b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
new file mode 100644
index 00000000000..b03ab096ed5
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.test.ts
@@ -0,0 +1,160 @@
+/**
+ * @vitest-environment node
+ */
+import type { Principal } from '@sim/auth/principal'
+import { describe, expect, it } from 'vitest'
+import {
+  admitContent,
+  admitWrittenContent,
+  type ContentDeliveryGate,
+  type ContentSource,
+  noteContentDeliveryOperation,
+  runDeclaredContentOperation,
+} from '@/lib/core/application'
+import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
+import {
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+  isCommittedWriteResponse,
+} from '@/lib/mothership/content-delivery/dispatch'
+
+const now = Date.now()
+const CHAT: Principal = {
+  kind: 'delegated',
+  serviceId: 'copilot',
+  subjectUserId: 'user-1',
+  workspaceId: 'workspace-1',
+  delegationId: 'delegation-1',
+  audience: 'sim:test',
+  issuedAt: new Date(now),
+  expiresAt: new Date(now + 60_000),
+}
+
+const SOURCED = defineWorkspaceOperation({
+  id: 'test.sourced',
+  contentDelivery: 'sourced',
+  minimumRole: 'read',
+  workspaceApiKey: 'deny',
+  principalKinds: ['delegated'],
+  delegatedServices: ['copilot'],
+  capability: 'none',
+})
+
+const ENTRY = { encryptedValue: 'ciphertext-1', sourceUserId: 'user-1', name: 'TOKEN' }
+
+const ADMIT_ALL: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(() => true)
+  },
+}
+
+const SOURCE: ContentSource = {
+  kind: 'workspace-file',
+  id: 'file-1',
+  provenance: { status: 'exact', entries: [ENTRY] },
+  view: 'complete',
+}
+
+describe('dispatchUnderContentGate', () => {
+  it('rethrows a gate failure the route had mapped to its own error response', async () => {
+    const failure = new Error('history unavailable')
+    const failing: ContentDeliveryGate = {
+      async admit() {
+        throw failure
+      },
+    }
+    await expect(
+      dispatchUnderContentGate(failing, async () => {
+        try {
+          await admitContent(CHAT, [SOURCE])
+        } catch {
+          return Response.json({ error: 'internal' }, { status: 500 })
+        }
+        return Response.json({ data: 'unreachable' })
+      })
+    ).rejects.toMatchObject({
+      name: 'ContentGateFailure',
+      gateFailure: failure,
+      committedWrite: false,
+    })
+  })
+
+  it('marks a withheld response to a committed write, so what it changed is still refreshed', async () => {
+    const refusing: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => false)
+      },
+    }
+    const { response } = await dispatchUnderContentGate(refusing, async () => {
+      const outcome = await runDeclaredContentOperation(SOURCED, CHAT, async () => {
+        await admitWrittenContent(CHAT, [SOURCE])
+        return 'saved'
+      }).catch(() => 'withheld')
+      return Response.json({ error: outcome }, { status: 403 })
+    })
+    expect(response.status).toBe(403)
+    expect(isCommittedWriteResponse(response)).toBe(true)
+  })
+
+  it('replaces any successful response that never classified its content with a 403', async () => {
+    for (const status of [200, 201]) {
+      const { response, admitted } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+        noteContentDeliveryOperation(SOURCED, CHAT)
+        return Response.json({ data: 'unclassified content' }, { status })
+      })
+      expect(response.status).toBe(403)
+      const body = await response.text()
+      expect(body).not.toContain('unclassified content')
+      expect(JSON.parse(body)).toMatchObject({ error: { code: 'FORBIDDEN' } })
+      expect(admitted).toEqual([])
+    }
+  })
+
+  it('passes an error response through, since it carries no content to classify', async () => {
+    const { response } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      return Response.json({ error: { code: 'NOT_FOUND' } }, { status: 404 })
+    })
+    expect(response.status).toBe(404)
+  })
+
+  it('passes a classified response with the provenance of what it admitted', async () => {
+    const { response, admitted } = await dispatchUnderContentGate(ADMIT_ALL, async () => {
+      noteContentDeliveryOperation(SOURCED, CHAT)
+      await admitContent(CHAT, [SOURCE])
+      return Response.json({ data: 'classified' })
+    })
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ data: 'classified' })
+    expect(admitted).toEqual([SOURCE.provenance])
+  })
+})
+
+describe('deliveredFileProvenance', () => {
+  it('is clean for nothing delivered, and merges every admitted item’s entries', () => {
+    expect(deliveredFileProvenance([])).toEqual({ status: 'exact', entries: [] })
+    const other = { encryptedValue: 'ciphertext-2', sourceUserId: 'user-2' }
+    const merged = deliveredFileProvenance([
+      { status: 'exact', entries: [ENTRY] },
+      { status: 'exact', entries: [other] },
+      { status: 'exact', entries: [] },
+    ])
+    expect(merged.status).toBe('exact')
+    expect(merged.status === 'exact' && merged.entries).toEqual(
+      expect.arrayContaining([ENTRY, other])
+    )
+  })
+
+  it('stays unknown when any delivered item was unknown, and unrecorded when one was', () => {
+    expect(
+      deliveredFileProvenance([{ status: 'exact', entries: [ENTRY] }, { status: 'unknown' }])
+    ).toEqual({ status: 'unknown' })
+    expect(deliveredFileProvenance([{ status: 'unrecorded' }]).status).toBe('unrecorded')
+  })
+
+  it('reads an entry with no owner as unknown, since it cannot be re-bound to a file', () => {
+    expect(
+      deliveredFileProvenance([{ status: 'exact', entries: [{ encryptedValue: 'ciphertext-3' }] }])
+    ).toEqual({ status: 'unknown' })
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/dispatch.ts b/apps/sim/lib/mothership/content-delivery/dispatch.ts
new file mode 100644
index 00000000000..6d8e07335d3
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/dispatch.ts
@@ -0,0 +1,69 @@
+import {
+  type ContentDeliveryGate,
+  ContentGateFailure,
+  type ContentProvenance,
+  observeContentDelivery,
+  trackContentDelivery,
+} from '@/lib/core/application'
+import {
+  mergeWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { parseWorkspaceFileSecretProvenance } from '@/lib/uploads/upload-session/workspace-file-provenance'
+import { v2Error } from '@/app/api/v2/lib/response'
+
+const UNCLASSIFIED_CONTENT_MESSAGE =
+  'This result cannot be returned to Chat because its content was not checked for secret values.'
+
+const committedWrites = new WeakSet<Response>()
+
+/**
+ * Whether a refused or failed response answers a write that committed: the change happened even
+ * though its result is withheld, so what it changed still needs refreshing.
+ */
+export function isCommittedWriteResponse(response: Response): boolean {
+  return committedWrites.has(response)
+}
+
+/** Marks a response a transport built itself for a write that committed; see above. */
+export function markCommittedWriteResponse(response: Response): Response {
+  committedWrites.add(response)
+  return response
+}
+
+/**
+ * Dispatches one Chat request under `gate`, whatever its method. A successful response from an
+ * operation declared to return stored content that never classified it is replaced by a `403`, so
+ * a route that forgets to report its content fails closed instead of passing it to a model. A
+ * failure of the gate itself is rethrown, for the transport to answer.
+ */
+export async function dispatchUnderContentGate(
+  gate: ContentDeliveryGate,
+  dispatch: () => Promise<Response>
+): Promise<{ response: Response; admitted: readonly ContentProvenance[] }> {
+  const record = await observeContentDelivery(gate, () => trackContentDelivery(dispatch))
+  if (record.committedWrite) committedWrites.add(record.result)
+  /**
+   * A gate that failed to decide is the transport's to answer, not the route's: the route mapped
+   * it to a generic error, and a write it interrupted may already have committed.
+   */
+  if (record.gateFailure !== undefined) {
+    await record.result.body?.cancel().catch(() => {})
+    throw new ContentGateFailure(record.gateFailure, record.committedWrite)
+  }
+  if (record.unaccounted && record.result.ok) {
+    await record.result.body?.cancel().catch(() => {})
+    return { response: v2Error('FORBIDDEN', UNCLASSIFIED_CONTENT_MESSAGE), admitted: [] }
+  }
+  return { response: record.result, admitted: record.admitted }
+}
+
+/**
+ * The classification a persisted copy of the delivered bytes keeps. An entry with no owner cannot
+ * be re-bound to a file, so it reads as unknown rather than as clean.
+ */
+export function deliveredFileProvenance(
+  admitted: readonly ContentProvenance[]
+): WorkspaceFileSecretProvenance {
+  return mergeWorkspaceFileSecretProvenance(...admitted.map(parseWorkspaceFileSecretProvenance))
+}
diff --git a/apps/sim/lib/mothership/content-delivery/index.ts b/apps/sim/lib/mothership/content-delivery/index.ts
new file mode 100644
index 00000000000..8e61d78283f
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/index.ts
@@ -0,0 +1,8 @@
+export {
+  deliveredFileProvenance,
+  dispatchUnderContentGate,
+  isCommittedWriteResponse,
+  markCommittedWriteResponse,
+} from './dispatch'
+export { createRegistryContentGate } from './registry-gate'
+export { createSessionContentGate, WorkbenchProvenanceUnavailableError } from './session-gate'
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
new file mode 100644
index 00000000000..61fcec2f5da
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.test.ts
@@ -0,0 +1,233 @@
+/**
+ * @vitest-environment node
+ */
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+const telemetry = vi.hoisted(() => ({
+  reportDurableSecretProvenanceRefusal: vi.fn(),
+  reportDurableSecretProvenanceUnrecordedBatch: vi.fn(),
+}))
+vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
+
+import {
+  type ContentProvenance,
+  type ContentSource,
+  observeContentDelivery,
+  redactBeforeCutting,
+} from '@/lib/core/application'
+import { PROVENANCE_MAX_ENTRIES } from '@/lib/execution/provenance-limits'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
+import { sliceFileTextLines } from '@/lib/workspace-files/text-lines'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/** Ciphertext is `enc:<plaintext>`; `enc:` alone stands for a value whose key was rotated away. */
+const SECRET = 'SYNTHETIC_GATE_SECRET_4F7'
+const OTHER_SECRET = 'SYNTHETIC_OTHER_SECRET_9C2'
+
+function exact(...plaintexts: string[]): ContentProvenance {
+  return {
+    status: 'exact',
+    entries: plaintexts.map((plaintext) => ({
+      encryptedValue: `enc:${plaintext}`,
+      sourceUserId: 'user-1',
+      sourceWorkspaceId: 'workspace-1',
+      name: 'FIXTURE_TOKEN',
+    })),
+  }
+}
+
+function item(
+  id: string,
+  provenance: ContentProvenance,
+  view: ContentSource['view'] = 'complete'
+): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view }
+}
+
+function newRegistry() {
+  return new ResolvedSecretTraceRegistry([], { userId: 'user-1', workspaceId: 'workspace-1' })
+}
+
+/** What Chat's model receives for `text` under `registry`, as egress projects it. */
+function modelView(text: string, registry: ResolvedSecretTraceRegistry) {
+  const projection = projectResolvedSecretModelContent(text, registry.forkForPropagatedEntries())
+  return projection.safe ? projection.value : undefined
+}
+
+beforeEach(() => {
+  encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => {
+    const plaintext = value.slice('enc:'.length)
+    if (!plaintext) throw new Error('decryption failed')
+    return { decrypted: plaintext }
+  })
+})
+
+describe('createRegistryContentGate', () => {
+  it('admits clean and unrecorded items, reporting the unrecorded ones once per batch', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({
+      registry,
+      workspaceId: 'workspace-1',
+      actorUserId: 'user-1',
+    })
+    const verdicts = await gate.admit([
+      item('clean', { status: 'exact', entries: [] }),
+      item('untracked', { status: 'unrecorded' }, 'opaque'),
+    ])
+    expect(verdicts).toEqual([true, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledTimes(1)
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledWith([
+      expect.objectContaining({ resourceId: 'untracked', surface: 'workspace-file' }),
+    ])
+  })
+
+  it('imports a complete item’s secrets so egress redacts them', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET))])).toEqual([true])
+    const view = modelView(`token=${SECRET}`, registry)
+    expect(view).toBeDefined()
+    expect(view).not.toContain(SECRET)
+    expect(view).toContain('{{FIXTURE_TOKEN}}')
+  })
+
+  it('imports only the secrets a derived view contains', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const derived = { excerpt: `token=${SECRET}` }
+    expect(await gate.admit([item('config', exact(SECRET, OTHER_SECRET), { derived })])).toEqual([
+      true,
+    ])
+    expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
+    /** The other secret is not in what this result shows, so it is not activated by it. */
+    expect(modelView(`other=${OTHER_SECRET}`, registry)).toContain(OTHER_SECRET)
+    expect(encryptionMockFns.mockDecryptSecret).toHaveBeenCalledTimes(2)
+  })
+
+  it('activates nothing for a derived view that shows nothing', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET), { derived: undefined })])).toEqual([
+      true,
+    ])
+    expect(modelView(`token=${SECRET}`, registry)).toContain(SECRET)
+  })
+
+  it('refuses an opaque view of an item holding secrets, which no redaction reaches', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('archive', exact(SECRET), 'opaque')])).toEqual([false])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(telemetry.reportDurableSecretProvenanceRefusal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        resourceId: 'archive',
+        cause: 'workspace-file-opaque-secret-content',
+      })
+    )
+  })
+
+  it('refuses an item holding secrets when there is no registry to redact with', async () => {
+    const gate = createRegistryContentGate({ actorUserId: 'user-1' })
+    expect(await gate.admit([item('config', exact(SECRET))])).toEqual([false])
+  })
+
+  it('refuses an unknown item without latching the registry', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+  })
+
+  it('admits an unknown item under taint and withholds the whole output instead (D7)', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1', unknown: 'taint' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([true])
+    expect(registry.isPermanentlyIncomplete()).toBe(true)
+    expect(modelView('anything at all', registry)).toBeUndefined()
+  })
+
+  it('refuses an unknown item under taint when no registry could withhold the output', async () => {
+    const gate = createRegistryContentGate({ actorUserId: 'user-1', unknown: 'taint' })
+    expect(await gate.admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+  })
+
+  it('refuses only the item whose secrets cannot be imported, keeping the rest of the call', async () => {
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const rotated: ContentProvenance = {
+      status: 'exact',
+      entries: [{ encryptedValue: 'enc:', sourceUserId: 'user-1', name: 'ROTATED' }],
+    }
+    const verdicts = await gate.admit([
+      item('rotated', rotated),
+      item('config', exact(SECRET)),
+      item('clean', { status: 'exact', entries: [] }),
+    ])
+    expect(verdicts).toEqual([false, true, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`token=${SECRET}`, registry)).not.toContain(SECRET)
+  })
+
+  it('refuses an item that exceeds the remaining capacity without withholding earlier content', async () => {
+    const registry = newRegistry()
+    const values = Array.from(
+      { length: PROVENANCE_MAX_ENTRIES - 1 },
+      (_, index) => `SYNTHETIC_EXISTING_SECRET_${index}`
+    )
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('existing', exact(...values))])).toEqual([true])
+
+    expect(await gate.admit([item('overflow', exact(SECRET, OTHER_SECRET))])).toEqual([false])
+
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`public notes token=${values[0]}`, registry)).toBe(
+      'public notes token={{FIXTURE_TOKEN}}'
+    )
+    expect(modelView(`new token=${SECRET}`, registry)).toContain(SECRET)
+  })
+
+  it('admits only the concurrent item that fits without tainting the shared registry', async () => {
+    const registry = newRegistry()
+    const values = Array.from(
+      { length: PROVENANCE_MAX_ENTRIES - 1 },
+      (_, index) => `SYNTHETIC_EXISTING_SECRET_${index}`
+    )
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    expect(await gate.admit([item('existing', exact(...values))])).toEqual([true])
+
+    const verdicts = await Promise.all([
+      gate.admit([item('first', exact(SECRET))]),
+      gate.admit([item('second', exact(OTHER_SECRET))]),
+    ])
+
+    expect(verdicts.flat().sort()).toEqual([false, true])
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(modelView(`public notes token=${values[0]}`, registry)).toBe(
+      'public notes token={{FIXTURE_TOKEN}}'
+    )
+    expect(registry.exportProvenance().entries).toHaveLength(PROVENANCE_MAX_ENTRIES)
+  })
+
+  it('redacts a multi-line secret before a line window could cut one line out of it', async () => {
+    const key = ['-----BEGIN FIXTURE KEY-----', 'FIXTURELINEONE0123', 'FIXTURELINETWO4567'].join(
+      '\n'
+    )
+    const registry = newRegistry()
+    const gate = createRegistryContentGate({ registry, actorUserId: 'user-1' })
+    const text = `config\n${key}\nend`
+    const window = await observeContentDelivery(gate, async () => {
+      expect(await gate.admit([item('key-file', exact(key))])).toEqual([true])
+      return sliceFileTextLines(
+        await redactBeforeCutting(undefined, text, 'workspace-file'),
+        2,
+        1,
+        false
+      )
+    })
+    for (const line of key.split('\n')) expect(window.text).not.toContain(line)
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/registry-gate.ts b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
new file mode 100644
index 00000000000..6dc499c4324
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/registry-gate.ts
@@ -0,0 +1,92 @@
+import type { ContentDeliveryGate, ContentSource } from '@/lib/core/application'
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import {
+  type DurableSecretProvenanceUnrecordedReport,
+  reportDurableSecretProvenanceUnrecordedBatch,
+} from '@/lib/execution/durable-secret-provenance-telemetry'
+import {
+  CONTENT_SURFACE,
+  type ContentRefusalReason,
+  reportContentRefusal,
+} from '@/lib/mothership/content-delivery/telemetry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+export interface RegistryContentGateScope {
+  /** The registry whose projection is the output Chat's model receives. */
+  registry?: ResolvedSecretTraceRegistry
+  workspaceId?: string
+  organizationId?: string
+  actorUserId: string
+  /**
+   * `taint` admits an unknown item and latches the registry, so the whole output is withheld and
+   * anything persisted from it stays unknown. Only a direct single-file download takes it (D7).
+   */
+  unknown?: 'refuse' | 'taint'
+}
+
+/**
+ * Decides items against a model registry: an item's exact secrets are imported so egress redacts
+ * them. Atomic admission checks decryption and the registry's remaining capacity before activating
+ * any entry, so a refused item cannot latch the registry for every other item.
+ */
+export function createRegistryContentGate(scope: RegistryContentGateScope): ContentDeliveryGate {
+  const refuse = (source: ContentSource, reason: ContentRefusalReason): false =>
+    reportContentRefusal(source, reason, scope.workspaceId)
+
+  const decide = async (
+    source: ContentSource,
+    unrecorded: DurableSecretProvenanceUnrecordedReport[]
+  ): Promise<boolean> => {
+    const { provenance } = source
+    if (provenance.status === 'unknown') {
+      /** Taint needs a registry to latch; without one the bytes would reach the model as is. */
+      if (scope.unknown !== 'taint' || !scope.registry) return refuse(source, 'unknown')
+      scope.registry.markIncomplete('workspace-file-provenance-unknown')
+      return true
+    }
+    if (provenance.status === 'unrecorded') {
+      unrecorded.push({
+        surface: CONTENT_SURFACE[source.kind],
+        workspaceId: scope.workspaceId,
+        organizationId: scope.organizationId,
+        resourceId: source.id,
+        actorUserId: scope.actorUserId,
+      })
+      return true
+    }
+    if (provenance.entries.length === 0) return true
+    if (source.view === 'opaque' || source.view === 'excerpt') return refuse(source, 'opaque')
+    const registry = scope.registry
+    if (!registry) return refuse(source, 'registry')
+    /** A derived view that shows nothing needs no entry; `undefined` would mean the whole item. */
+    if (typeof source.view === 'object' && source.view.derived === undefined) return true
+    const value = typeof source.view === 'object' ? source.view.derived : undefined
+    if (!(await importDurableSecretProvenance(registry, provenance, value, { atomic: true }))) {
+      return refuse(source, 'import')
+    }
+    return true
+  }
+
+  return {
+    project(text) {
+      /** Without a registry no admitted item holds a secret, so there is nothing to redact. */
+      if (!scope.registry) return text
+      /** File extraction already bounds this scalar; final egress limits the selected output. */
+      const projection = projectResolvedSecretModelContent(
+        text,
+        scope.registry.forkForPropagatedEntries(),
+        Number.POSITIVE_INFINITY,
+        { preserveLineBreaks: true }
+      )
+      return projection.safe && typeof projection.value === 'string' ? projection.value : undefined
+    },
+    async admit(sources) {
+      const unrecorded: DurableSecretProvenanceUnrecordedReport[] = []
+      const verdicts: boolean[] = []
+      for (const source of sources) verdicts.push(await decide(source, unrecorded))
+      reportDurableSecretProvenanceUnrecordedBatch(unrecorded)
+      return verdicts
+    },
+  }
+}
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.test.ts b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
new file mode 100644
index 00000000000..164c2646bb7
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.test.ts
@@ -0,0 +1,83 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+/** The workbench history lives in Redis beside a remote machine; only its write is observed. */
+const history = vi.hoisted(() => ({ recordExistingSessionFileInput: vi.fn() }))
+vi.mock('@/lib/execution/remote-sandbox/session-file-provenance', () => history)
+const telemetry = vi.hoisted(() => ({
+  reportDurableSecretProvenanceRefusal: vi.fn(),
+  reportDurableSecretProvenanceUnrecordedBatch: vi.fn(),
+}))
+vi.mock('@/lib/execution/durable-secret-provenance-telemetry', () => telemetry)
+
+import type { ContentProvenance, ContentSource } from '@/lib/core/application'
+import {
+  createSessionContentGate,
+  WorkbenchProvenanceUnavailableError,
+} from '@/lib/mothership/content-delivery/session-gate'
+
+const ENTRY = {
+  encryptedValue: 'ciphertext-1',
+  sourceUserId: 'user-1',
+  sourceWorkspaceId: 'workspace-1',
+  name: 'FIXTURE_TOKEN',
+}
+
+function item(id: string, provenance: ContentProvenance): ContentSource {
+  return { kind: 'workspace-file', id, provenance, view: 'opaque' }
+}
+
+const gate = () =>
+  createSessionContentGate({
+    sessionKey: 'session-1',
+    workspaceId: 'workspace-1',
+    actorUserId: 'user-1',
+  })
+
+beforeEach(() => {
+  history.recordExistingSessionFileInput.mockResolvedValue(undefined)
+})
+
+describe('createSessionContentGate', () => {
+  it('keeps an unknown item out of the machine and its history', async () => {
+    expect(await gate().admit([item('tainted', { status: 'unknown' })])).toEqual([false])
+    expect(history.recordExistingSessionFileInput).not.toHaveBeenCalled()
+    expect(telemetry.reportDurableSecretProvenanceRefusal).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: 'tainted' })
+    )
+  })
+
+  it('admits secret-bearing bytes, even opaque, after merging their entries into the history', async () => {
+    const verdicts = await gate().admit([
+      item('config', { status: 'exact', entries: [ENTRY] }),
+      item('tainted', { status: 'unknown' }),
+      item('clean', { status: 'exact', entries: [] }),
+    ])
+    expect(verdicts).toEqual([true, false, true])
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledTimes(1)
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledWith('session-1', {
+      status: 'exact',
+      entries: [ENTRY],
+    })
+  })
+
+  it('records an unrecorded item as clean history and reports the absence', async () => {
+    expect(await gate().admit([item('untracked', { status: 'unrecorded' })])).toEqual([true])
+    expect(history.recordExistingSessionFileInput).toHaveBeenCalledWith('session-1', {
+      status: 'exact',
+      entries: [],
+    })
+    expect(telemetry.reportDurableSecretProvenanceUnrecordedBatch).toHaveBeenCalledWith([
+      expect.objectContaining({ recordCount: 1, workspaceId: 'workspace-1' }),
+    ])
+  })
+
+  it('lets nothing in when the history cannot be widened', async () => {
+    history.recordExistingSessionFileInput.mockRejectedValue(new Error('redis unavailable'))
+    await expect(
+      gate().admit([item('clean', { status: 'exact', entries: [] })])
+    ).rejects.toBeInstanceOf(WorkbenchProvenanceUnavailableError)
+  })
+})
diff --git a/apps/sim/lib/mothership/content-delivery/session-gate.ts b/apps/sim/lib/mothership/content-delivery/session-gate.ts
new file mode 100644
index 00000000000..a5fc9e387f3
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/session-gate.ts
@@ -0,0 +1,104 @@
+import type { ContentDeliveryGate } from '@/lib/core/application'
+import {
+  createDurableSecretProvenanceRegistry,
+  type DurableSecretProvenance,
+  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
+  mergeDurableSecretProvenance,
+} from '@/lib/execution/durable-secret-provenance'
+import { reportDurableSecretProvenanceUnrecordedBatch } from '@/lib/execution/durable-secret-provenance-telemetry'
+import { recordExistingSessionFileInput } from '@/lib/execution/remote-sandbox/session-file-provenance'
+import { reportContentRefusal } from '@/lib/mothership/content-delivery/telemetry'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+
+/** The workbench's history could not be widened, so nothing may enter the machine. */
+export class WorkbenchProvenanceUnavailableError extends Error {
+  constructor(cause: unknown) {
+    super('Workbench secret provenance could not be recorded', { cause })
+    this.name = 'WorkbenchProvenanceUnavailableError'
+  }
+}
+
+/**
+ * Decides items entering run_code's workbench. An unknown item never enters the machine, so the
+ * machine's history stays exact and one tainted file cannot withhold every later run in the chat.
+ * Everything admitted is merged into the history before its bytes are returned, which is what keeps
+ * files the machine later derives from it carrying its secrets.
+ */
+export function createSessionContentGate(scope: {
+  sessionKey: string
+  workspaceId: string
+  actorUserId: string
+}): ContentDeliveryGate {
+  return {
+    async project(text, provenance) {
+      if (!provenance || provenance.status === 'unrecorded') return text
+      try {
+        const registry = await createDurableSecretProvenanceRegistry(provenance, {
+          userId: scope.actorUserId,
+          workspaceId: scope.workspaceId,
+        })
+        if (!registry) return text
+        /** File extraction already bounds this scalar; final egress limits the selected output. */
+        const projection = projectResolvedSecretModelContent(
+          text,
+          registry.forkForPropagatedEntries(),
+          Number.POSITIVE_INFINITY,
+          { preserveLineBreaks: true }
+        )
+        return projection.safe && typeof projection.value === 'string'
+          ? projection.value
+          : undefined
+      } catch {
+        return undefined
+      }
+    },
+    async admit(sources) {
+      const verdicts: boolean[] = []
+      const admitted: DurableSecretProvenance[] = []
+      let unrecorded = 0
+      for (const source of sources) {
+        const { provenance } = source
+        if (provenance.status === 'unknown') {
+          verdicts.push(reportContentRefusal(source, 'unknown', scope.workspaceId))
+          continue
+        }
+        if (
+          provenance.status === 'exact' &&
+          provenance.entries.length > 0 &&
+          source.view === 'excerpt'
+        ) {
+          verdicts.push(reportContentRefusal(source, 'opaque', scope.workspaceId))
+          continue
+        }
+        if (provenance.status === 'unrecorded') {
+          unrecorded += 1
+          admitted.push(EXACT_EMPTY_DURABLE_SECRET_PROVENANCE)
+        } else {
+          admitted.push(provenance)
+        }
+        verdicts.push(true)
+      }
+      if (admitted.length > 0) {
+        try {
+          await recordExistingSessionFileInput(
+            scope.sessionKey,
+            mergeDurableSecretProvenance(...admitted)
+          )
+        } catch (error) {
+          throw new WorkbenchProvenanceUnavailableError(error)
+        }
+      }
+      if (unrecorded > 0) {
+        reportDurableSecretProvenanceUnrecordedBatch([
+          {
+            surface: 'workspace-file',
+            workspaceId: scope.workspaceId,
+            actorUserId: scope.actorUserId,
+            recordCount: unrecorded,
+          },
+        ])
+      }
+      return verdicts
+    },
+  }
+}
diff --git a/apps/sim/lib/mothership/content-delivery/telemetry.ts b/apps/sim/lib/mothership/content-delivery/telemetry.ts
new file mode 100644
index 00000000000..658aee2a55e
--- /dev/null
+++ b/apps/sim/lib/mothership/content-delivery/telemetry.ts
@@ -0,0 +1,71 @@
+import type { ContentSource, ContentSourceKind } from '@/lib/core/application'
+import {
+  type DurableSecretProvenanceRefusalCause,
+  type DurableSecretProvenanceSurface,
+  reportDurableSecretProvenanceRefusal,
+} from '@/lib/execution/durable-secret-provenance-telemetry'
+
+export type ContentRefusalReason = 'unknown' | 'opaque' | 'registry' | 'import'
+
+export const CONTENT_SURFACE: Record<ContentSourceKind, DurableSecretProvenanceSurface> = {
+  'workspace-file': 'workspace-file',
+  'execution-file': 'workspace-file',
+  'knowledge-document': 'knowledge',
+  'knowledge-chunk': 'knowledge',
+  'table-row': 'table-row',
+  'tool-result': 'tool-result',
+}
+
+const FILE_CAUSES: Record<ContentRefusalReason, DurableSecretProvenanceRefusalCause> = {
+  unknown: 'workspace-file-provenance-unavailable',
+  opaque: 'workspace-file-opaque-secret-content',
+  registry: 'workspace-file-registry-unavailable',
+  import: 'workspace-file-provenance-unavailable',
+}
+
+const CAUSES: Record<
+  ContentSourceKind,
+  Record<ContentRefusalReason, DurableSecretProvenanceRefusalCause>
+> = {
+  'workspace-file': FILE_CAUSES,
+  'execution-file': FILE_CAUSES,
+  'knowledge-document': {
+    unknown: 'knowledge-document-source-unavailable',
+    opaque: 'knowledge-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'knowledge-result-provenance-unavailable',
+  },
+  'knowledge-chunk': {
+    unknown: 'knowledge-chunk-source-unavailable',
+    opaque: 'knowledge-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'knowledge-result-provenance-unavailable',
+  },
+  'tool-result': {
+    unknown: 'tool-result-provenance-unavailable',
+    opaque: 'tool-result-provenance-unavailable',
+    registry: 'content-registry-unavailable',
+    import: 'tool-result-provenance-unavailable',
+  },
+  'table-row': {
+    unknown: 'table-row-provenance-unavailable',
+    opaque: 'table-row-opaque-secret-content',
+    registry: 'content-registry-unavailable',
+    import: 'table-row-provenance-unavailable',
+  },
+}
+
+/** Names the refused item and why, never its content. */
+export function reportContentRefusal(
+  source: ContentSource,
+  reason: ContentRefusalReason,
+  workspaceId: string | undefined
+): false {
+  reportDurableSecretProvenanceRefusal({
+    surface: CONTENT_SURFACE[source.kind],
+    cause: CAUSES[source.kind][reason],
+    workspaceId,
+    resourceId: source.id,
+  })
+  return false
+}
diff --git a/apps/sim/lib/mothership/integrations/application/catalog.ts b/apps/sim/lib/mothership/integrations/application/catalog.ts
index f014f55f932..ab3022c379e 100644
--- a/apps/sim/lib/mothership/integrations/application/catalog.ts
+++ b/apps/sim/lib/mothership/integrations/application/catalog.ts
@@ -39,6 +39,7 @@ export const readIntegrationCatalogOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot', 'executor'],
 })
@@ -130,6 +131,7 @@ const catalogUseCase = defineAuthorizedChatUseCase({
   operation: readIntegrationCatalogOperation,
   organizationOperation: defineOrganizationOperation({
     id: readIntegrationCatalogOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/memory/application/read-scope.ts b/apps/sim/lib/mothership/memory/application/read-scope.ts
index df6b7331fc1..57cd3791f82 100644
--- a/apps/sim/lib/mothership/memory/application/read-scope.ts
+++ b/apps/sim/lib/mothership/memory/application/read-scope.ts
@@ -11,6 +11,7 @@ import { requireOwnedMemorySpace } from '@/lib/mothership/memory/spaces'
 export const MEMORY_SCOPE_AUDIENCE = 'sim:copilot-memory'
 export const readMemoryScopeOperation = defineWorkspaceOperation({
   id: 'mothership.memory.read_scope',
+  contentDelivery: 'none',
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
@@ -23,6 +24,7 @@ export const readMemoryScope = defineAuthorizedChatUseCase({
   operation: readMemoryScopeOperation,
   organizationOperation: defineOrganizationOperation({
     id: readMemoryScopeOperation.id,
+    contentDelivery: readMemoryScopeOperation.contentDelivery,
     minimumRole: 'member',
     capability: readMemoryScopeOperation.capability,
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/request/application/read-control.ts b/apps/sim/lib/mothership/request/application/read-control.ts
index c8984964af0..b882ca60fd5 100644
--- a/apps/sim/lib/mothership/request/application/read-control.ts
+++ b/apps/sim/lib/mothership/request/application/read-control.ts
@@ -14,6 +14,7 @@ export const readRunControlOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
@@ -23,6 +24,7 @@ export const readRunControl = defineAuthorizedChatUseCase({
   /** permission-group-exempt: observing Stop must remain available after Assistant access is withheld. */
   organizationOperation: defineOrganizationOperation({
     id: readRunControlOperation.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: readRunControlOperation.capability,
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/tasks/application/operations.ts b/apps/sim/lib/mothership/tasks/application/operations.ts
index ae44b3e45e1..1bd995576a2 100644
--- a/apps/sim/lib/mothership/tasks/application/operations.ts
+++ b/apps/sim/lib/mothership/tasks/application/operations.ts
@@ -21,11 +21,13 @@ export const taskOperations = {
     id: 'mothership.tasks.workflow_status',
     ...taskPrincipalPolicy,
     capability: 'copilot.use',
+    contentDelivery: 'none',
   }),
   wake: defineWorkspaceOperation({
     id: 'mothership.tasks.wake',
     ...taskPrincipalPolicy,
     capability: 'copilot.use',
+    contentDelivery: 'none',
   }),
 } as const
 
@@ -38,6 +40,7 @@ export const organizationTaskOperations = {
   }),
   readWorkflowStatus: defineOrganizationOperation({
     id: taskOperations.readWorkflowStatus.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
@@ -46,6 +49,7 @@ export const organizationTaskOperations = {
   }),
   wake: defineOrganizationOperation({
     id: taskOperations.wake.id,
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/mothership/tool-executor/executor.ts b/apps/sim/lib/mothership/tool-executor/executor.ts
index 0d0c6986fb2..de809a77612 100644
--- a/apps/sim/lib/mothership/tool-executor/executor.ts
+++ b/apps/sim/lib/mothership/tool-executor/executor.ts
@@ -1,10 +1,12 @@
 import { createLogger } from '@sim/logger'
 import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
 import { toError } from '@sim/utils/errors'
+import { observeContentDelivery } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import { ASSISTANT_TOOLS, isAssistantIntegrationTool } from '@/lib/mothership/assistant/tool-policy'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
 import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import { projectToolErrorMessageForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
@@ -196,6 +198,26 @@ async function executeBoundTool(
     }
   }
 
+  /**
+   * Every stored item a Sim-side tool returns to Chat — through a use case it calls directly, or
+   * through the CLI it runs — is admitted against this call's registry, so its secrets are redacted
+   * from the result and an unknown item is refused on its own.
+   */
+  const gate = createRegistryContentGate({
+    registry: context.resolvedSecretTraceRegistry,
+    workspaceId: context.workspaceId,
+    organizationId: context.chatOrganizationId ?? context.organizationId,
+    actorUserId: context.userId,
+  })
+  return observeContentDelivery(gate, () => executeGatedTool(toolId, params, context))
+}
+
+async function executeGatedTool(
+  toolId: string,
+  params: Record<string, unknown>,
+  context: ToolExecutionContext
+): Promise<ToolExecutionResult> {
+  const usesHeadlessClientFallback = isClientExecuted(toolId) && hasHandler(toolId)
   return withResourceOutboundScope(context, async () => {
     const canUseRegisteredHandler =
       hasHandler(toolId) &&
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
index d940ef76062..574901baba0 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts
@@ -34,7 +34,9 @@ vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/tools', () => toolsMock)
 
+import { observeContentDelivery } from '@/lib/core/application'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import type { ToolExecutionContext } from '@/lib/mothership/tool-executor/types'
 import {
@@ -99,17 +101,46 @@ function queueProvenance(status: 'exact' | 'unknown', currentRevision = revision
   ])
 }
 
-function run(
+/** Resolves inputs under the gate `run_code` installs over the run's own registry. */
+function resolveGated(
+  registry: ResolvedSecretTraceRegistry,
+  ...args: Parameters<typeof resolveInputFiles>
+) {
+  const [mountContext] = args
+  return observeContentDelivery(
+    createRegistryContentGate({
+      registry,
+      workspaceId: mountContext.workspaceId,
+      organizationId: mountContext.chatOrganizationId ?? mountContext.organizationId,
+      actorUserId: mountContext.userId,
+    }),
+    () => resolveInputFiles(...args)
+  )
+}
+
+function resolve(
   trace = new ResolvedSecretTraceRegistry([], { userId: 'reader', workspaceId: 'workspace' }),
   overrides: Partial<ToolExecutionContext> = {}
 ) {
-  return resolveInputFiles(
-    { ...context, ...overrides },
-    [{ path: 'file', sandboxPath: '/tmp/source.txt' }],
-    undefined,
-    undefined,
-    trace
-  )
+  return resolveGated(trace, { ...context, ...overrides }, [
+    { path: 'file', sandboxPath: '/tmp/source.txt' },
+  ])
+}
+
+async function run(...args: Parameters<typeof resolve>) {
+  const { files, excluded } = await resolve(...args)
+  expect(excluded).toEqual([])
+  return files
+}
+
+/** A file the gate refuses is left out on its own, before any byte or URL is acquired. */
+async function expectExcluded(...args: Parameters<typeof resolve>) {
+  const { files, excluded } = await resolve(...args)
+  expect(files).toEqual([])
+  expect(excluded).toEqual([{ path: '/tmp/source.txt', reason: expect.any(String) }])
+  expect(mocks.buffer).not.toHaveBeenCalled()
+  expect(mocks.presign).not.toHaveBeenCalled()
+  expect(mocks.render).not.toHaveBeenCalled()
 }
 
 function mountedBytes(mounts: SandboxFile[]) {
@@ -167,14 +198,9 @@ describe('Mothership file mounts bind content and classification to the same rec
       userId: 'reader',
       workspaceId: 'workspace',
     })
-    const mounts = await run(trace)
-    expect(mountedBytes(mounts).toString()).toBe(content)
-    const observation = inspectToolResultForCopilot(
-      { success: true, output: content },
-      trace,
-      'run_code'
-    )
-    expect(JSON.stringify(observation.result)).not.toContain(content)
+    await expectExcluded(trace)
+    /** Leaving the file out keeps the run's registry, and every later run in the chat, intact. */
+    expect(trace.isComplete()).toBe(true)
   })
 
   it.each(['safe', 'secret', 'unknown'] as const)(
@@ -185,6 +211,10 @@ describe('Mothership file mounts bind content and classification to the same rec
         userId: 'reader',
         workspaceId: 'workspace',
       })
+      if (kind === 'unknown') {
+        await expectExcluded(trace)
+        return
+      }
       expect(mountedBytes(await run(trace)).toString()).toBe(content)
       const observation = inspectToolResultForCopilot(
         { success: true, output: content },
@@ -197,9 +227,9 @@ describe('Mothership file mounts bind content and classification to the same rec
 
   /**
    * The run's code can read every mounted byte, so the per-call registry the Copilot projection
-   * and output-file writers read must carry the mount's own verdict across the crossing: a
-   * tainted mount stays a taint (never the `unrecorded` absence) and names the guard that tripped,
-   * while exact mounts keep redacting and clean mounts stay readable.
+   * and output-file writers read must carry the mount's own verdict across the crossing: exact
+   * mounts keep redacting and clean mounts stay readable, while an unknown file never enters the
+   * runtime and the requested code never runs with incomplete inputs.
    */
   it.each(['safe', 'secret', 'unknown'] as const)(
     'carries a %s mount verdict across the run_code crossing',
@@ -222,51 +252,46 @@ describe('Mothership file mounts bind content and classification to the same rec
         { ...context, resolvedSecretTraceRegistry: trace }
       )
 
+      if (kind === 'unknown') {
+        expect(toolsMockFns.mockExecuteTool).not.toHaveBeenCalled()
+        expect(result.success).toBe(false)
+        expect(mocks.buffer).not.toHaveBeenCalled()
+        expect(result.output).toMatchObject({
+          codeExecuted: false,
+          excludedInputs: [{ path: '/tmp/source.txt', reason: expect.any(String) }],
+        })
+        return
+      }
       const observation = inspectToolResultForCopilot(result, trace, 'run_code')
       const written = await createWorkspaceFileSecretProvenanceFromRegistry(trace, result.output, {
         userId: 'reader',
         workspaceId: 'workspace',
       })
       expect(JSON.stringify(observation.result).includes(content)).toBe(kind === 'safe')
-      if (kind === 'unknown') {
-        expect(observation.safe).toBe(false)
-        expect.soft(observation.safe ? undefined : observation.cause).toMatchObject({
-          kind: 'registry-incomplete',
-          reasons: expect.arrayContaining(['mounted-file-provenance-unavailable']),
-        })
-        expect.soft(written).toEqual({ safe: false })
-        expect(observation.result.output).toEqual({
-          resultWithheld: true,
-          withheldReason: expect.stringMatching(
-            /file, table, or document .* unknown secret provenance/
-          ),
-        })
-      } else {
-        expect(observation.safe).toBe(true)
-        expect(written).toMatchObject({
-          safe: true,
-          provenance: {
-            status: 'exact',
-            // A mounted file's secret crosses anonymously: its ciphertext binds it, not a name.
-            entries:
-              kind === 'secret'
-                ? [
-                    {
-                      encryptedValue: 'fixture-ciphertext',
-                      sourceUserId: 'reader',
-                      sourceWorkspaceId: 'workspace',
-                    },
-                  ]
-                : [],
-          },
-        })
-      }
+      expect(observation.safe).toBe(true)
+      expect(written).toMatchObject({
+        safe: true,
+        provenance: {
+          status: 'exact',
+          // A mounted file's secret crosses anonymously: its ciphertext binds it, not a name.
+          entries:
+            kind === 'secret'
+              ? [
+                  {
+                    encryptedValue: 'fixture-ciphertext',
+                    sourceUserId: 'reader',
+                    sourceWorkspaceId: 'workspace',
+                  },
+                ]
+              : [],
+        },
+      })
     }
   )
 
   it('denies revoked access before content or signed URL acquisition', async () => {
     mocks.permission.mockResolvedValue(null)
-    await expect(run()).rejects.toThrow('permissions')
+    await expect(resolve()).rejects.toThrow('permissions')
     expect(mocks.file).not.toHaveBeenCalled()
     expect(mocks.buffer).not.toHaveBeenCalled()
     expect(mocks.presign).not.toHaveBeenCalled()
@@ -294,36 +319,28 @@ describe('Mothership file mounts bind content and classification to the same rec
     expect(mocks.buffer).not.toHaveBeenCalled()
   })
 
-  it.each(['missing revision', 'sidecar outage'])(
-    'withholds model output on %s without discarding runtime bytes',
-    async (failure) => {
-      if (failure === 'missing revision')
-        mocks.file.mockResolvedValue({ ...file, contentUpdatedAt: null })
-      else dbChainMockFns.limit.mockRejectedValueOnce(new Error('Classification unavailable'))
-      const trace = new ResolvedSecretTraceRegistry([], {
-        userId: 'reader',
-        workspaceId: 'workspace',
-      })
-      expect(mountedBytes(await run(trace)).toString()).toBe(content)
-      expect(trace.isPermanentlyIncomplete()).toBe(true)
-      expect(
-        JSON.stringify(
-          inspectToolResultForCopilot({ success: true, output: content }, trace, 'run_code').result
-        )
-      ).not.toContain(content)
-    }
-  )
-
-  it('does not use a newer sidecar to certify a signed mount either', async () => {
-    mocks.cloud.mockReturnValue(true)
-    queueProvenance('exact', new Date(revision.getTime() + 1))
+  it('leaves out a file whose revision is missing, without touching the run registry', async () => {
+    mocks.file.mockResolvedValue({ ...file, contentUpdatedAt: null })
     const trace = new ResolvedSecretTraceRegistry([], {
       userId: 'reader',
       workspaceId: 'workspace',
     })
-    const mounts = await run(trace)
-    expect(mounts[0]).toMatchObject({ type: 'url' })
-    expect(trace.isPermanentlyIncomplete()).toBe(true)
+    await expectExcluded(trace)
+    expect(trace.isComplete()).toBe(true)
+  })
+
+  /** An outage is not a verdict: the run fails, retryable, before any byte is read. */
+  it('fails the mount on a classification outage before reading bytes', async () => {
+    dbChainMockFns.limit.mockRejectedValueOnce(new Error('Classification unavailable'))
+    await expect(resolve()).rejects.toThrow('Classification unavailable')
+    expect(mocks.buffer).not.toHaveBeenCalled()
+    expect(mocks.presign).not.toHaveBeenCalled()
+  })
+
+  it('does not use a newer sidecar to certify a signed mount either', async () => {
+    mocks.cloud.mockReturnValue(true)
+    queueProvenance('exact', new Date(revision.getTime() + 1))
+    await expectExcluded()
   })
 
   it('renders generated documents with the acting principal and retains the rendered bytes', async () => {
@@ -346,7 +363,7 @@ describe('Mothership file mounts bind content and classification to the same rec
   it('stops before acquiring a mount when the tool was already aborted', async () => {
     const controller = new AbortController()
     controller.abort(new Error('Stopped'))
-    await expect(run(undefined, { abortSignal: controller.signal })).rejects.toThrow('Stopped')
+    await expect(resolve(undefined, { abortSignal: controller.signal })).rejects.toThrow('Stopped')
     expect(mocks.context).not.toHaveBeenCalled()
     expect(mocks.buffer).not.toHaveBeenCalled()
     expect(mocks.presign).not.toHaveBeenCalled()
@@ -354,15 +371,15 @@ describe('Mothership file mounts bind content and classification to the same rec
 
   it('does not hand completed bytes to the runtime after Stop during their read', async () => {
     const controller = new AbortController()
+    queueProvenance('exact')
     mocks.buffer.mockImplementation(async () => {
       controller.abort(new Error('Stopped during read'))
       return Buffer.from(content)
     })
-    await expect(run(undefined, { abortSignal: controller.signal })).rejects.toThrow(
+    await expect(resolve(undefined, { abortSignal: controller.signal })).rejects.toThrow(
       'Stopped during read'
     )
     expect(mocks.buffer).toHaveBeenCalledTimes(1)
-    expect(dbChainMockFns.select).not.toHaveBeenCalled()
   })
 
   it('does not charge the supplied mount budget when byte acquisition fails', async () => {
@@ -396,7 +413,8 @@ describe('organization-owned upload mounts', () => {
   })
   it('mounts the exact authorized private chat upload with no workspace lookup', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
-    const result = await resolveInputFiles(
+    const result = await resolveGated(
+      registry,
       {
         ...context,
         workspaceId: undefined,
@@ -405,10 +423,10 @@ describe('organization-owned upload mounts', () => {
       },
       [{ path: 'uploads/upload', sandboxPath: '/tmp/input.txt' }],
       [],
-      [],
-      registry
+      []
     )
-    expect(result).toEqual([
+    expect(result.excluded).toEqual([])
+    expect(result.files).toEqual([
       {
         path: '/tmp/input.txt',
         content: Buffer.from('public input').toString('base64'),
@@ -445,7 +463,8 @@ describe('organization-owned upload mounts', () => {
         )
       }
       const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
-      const result = await resolveInputFiles(
+      const result = await resolveGated(
+        registry,
         {
           ...context,
           workspaceId: undefined,
@@ -454,10 +473,9 @@ describe('organization-owned upload mounts', () => {
         },
         [{ path: 'uploads/upload', sandboxPath: '/tmp/input.txt' }],
         [],
-        [],
-        registry
+        []
       )
-      expect(result).toEqual([
+      expect(result.files).toEqual([
         {
           path: '/tmp/input.txt',
           content: Buffer.from('public input').toString('base64'),
@@ -470,7 +488,8 @@ describe('organization-owned upload mounts', () => {
   it('does not repair an existing protection fault when an intentional upload is mounted', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
     registry.markIncomplete('entry-decrypt-failed')
-    const result = await resolveInputFiles(
+    const result = await resolveGated(
+      registry,
       {
         ...context,
         workspaceId: undefined,
@@ -479,31 +498,30 @@ describe('organization-owned upload mounts', () => {
       },
       [{ path: 'uploads/upload' }],
       [],
-      [],
-      registry
+      []
     )
-    expect(result).toHaveLength(1)
+    expect(result.files).toHaveLength(1)
     expect(registry.isPermanentlyIncomplete()).toBe(true)
   })
   it('requires a target for workspace files and never treats missing upload authority as a workspace fallback', async () => {
     const registry = new ResolvedSecretTraceRegistry([], { userId: 'reader' })
     await expect(
-      resolveInputFiles(
+      resolveGated(
+        registry,
         { ...context, workspaceId: undefined, organizationId: 'org' },
         [{ path: 'files/secret.txt' }],
         [],
-        [],
-        registry
+        []
       )
     ).rejects.toThrow('explicit workspace')
     mocks.attachment.mockRejectedValue(new Error('Attachment not found'))
     await expect(
-      resolveInputFiles(
+      resolveGated(
+        registry,
         { ...context, workspaceId: undefined, organizationId: 'org' },
         [{ path: 'uploads/foreign' }],
         [],
-        [],
-        registry
+        []
       )
     ).rejects.toThrow('Attachment not found')
     expect(mocks.find).not.toHaveBeenCalled()
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
index 97f3ae629c0..e5be1e94a53 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute-table-mounts.test.ts
@@ -201,27 +201,20 @@ describe('Mothership table mounts through code calls', () => {
     expect(mocks.execute).not.toHaveBeenCalled()
   })
 
-  it('retains snapshot provenance refusal and cloud transport without buffering', async () => {
+  it('stops before code execution when a requested table snapshot is refused', async () => {
     mocks.safety.mockResolvedValueOnce('stale')
     await expect(run('table-orders')).rejects.toThrow('changed while preparing')
     expect(mocks.presign).not.toHaveBeenCalled()
     mocks.cloud.mockReturnValue(true)
     mocks.safety.mockResolvedValue('unsafe-provenance')
-    await run('table-orders')
-    const params = mocks.execute.mock.calls[0][1]
-    expect(params._sandboxFiles).toEqual([
-      {
-        type: 'url',
-        path: '/tmp/orders.csv',
-        url: 'https://storage.invalid/snapshot',
-        maxBytes: 500 * 1024 * 1024,
-      },
-    ])
-    expect(mocks.presign).toHaveBeenCalledWith('snapshot.csv', 'execution', 1800)
+    const result = await run('table-orders')
+    expect(mocks.execute).not.toHaveBeenCalled()
+    expect(mocks.presign).not.toHaveBeenCalled()
     expect(mocks.download).not.toHaveBeenCalled()
-    expect(
-      mocks.execute.mock.calls[0][2].resolvedSecretTraceRegistry.exportProvenance().complete
-    ).toBe(false)
+    expect(result.output).toMatchObject({
+      codeExecuted: false,
+      excludedInputs: [{ path: 'table-orders', reason: expect.any(String) }],
+    })
   })
 
   it.each(['local', 'cloud'] as const)(
diff --git a/apps/sim/lib/mothership/tools/handlers/function-execute.ts b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
index ce761b5e7d5..190dca23d55 100644
--- a/apps/sim/lib/mothership/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/mothership/tools/handlers/function-execute.ts
@@ -2,6 +2,7 @@ import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { omit, toRecord } from '@sim/utils/object'
 import { hasWorkspaceSandboxAccess } from '@/lib/billing/core/subscription'
+import { ContentRefusedError, observeContentDelivery } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   durableSecretProvenanceFromEnvelope,
@@ -32,6 +33,7 @@ import { resolveCopilotFilePrincipal } from '@/lib/mothership/auth/file-delegati
 import { messageForCopilotTableError } from '@/lib/mothership/auth/table-delegation'
 import { recordServiceCost } from '@/lib/mothership/billing/service-observer'
 import { readChatAttachment } from '@/lib/mothership/chat/application/read-attachment'
+import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { WorkbenchSecretNames } from '@/lib/mothership/generated/workbench'
 import { applySecretMountPolicy } from '@/lib/mothership/secret-mount-policy'
 import type {
@@ -52,7 +54,6 @@ import {
   parseChatUploadReference,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import { importWorkspaceFileSnapshotProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { decodeVfsPathSegments, encodeVfsPathSegments } from '@/lib/vfs/path'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import {
@@ -77,46 +78,47 @@ const MAX_MOUNTED_FILES = 500
 const DEFAULT_TIMEOUT_SECONDS = 60
 const MAX_TIMEOUT_SECONDS = 300
 
-/** Keeps mount bytes, canonical classification and budget together until they enter the runtime. */
+/** An input the run asked for that was not mounted, and why; paths are the model's own. */
+export interface ExcludedInput {
+  path: string
+  reason: string
+}
+
+const UNVERIFIED_INPUT_REASON =
+  'Its secret provenance could not be verified, so code was not executed.'
+
+/**
+ * Mounts one file whose classification the installed gate admits. A file the gate refuses is left
+ * out and reported. The caller stops before executing code if any requested mount is refused;
+ * refused bytes never enter workbench history or disable later calls without those inputs.
+ */
 async function pushWorkspaceFileMount(
-  sandboxFiles: SandboxFile[],
+  mounts: ResolvedInputMounts,
   record: WorkspaceFileRecord,
   mountPath: string,
-  mounted: SandboxMountBudget,
   workspaceId: string,
   principal: Principal,
-  registry?: ResolvedSecretTraceRegistry,
   signal?: AbortSignal
 ): Promise<void> {
-  if (!registry) {
-    throw new Error(
-      `Input file "${mountPath}" cannot be mounted because its secret provenance is unavailable.`
-    )
-  }
-  const result = await readWorkspaceFileMount.execute({
-    principal,
-    input: {
-      fileId: record.id,
-      assertedWorkspaceId: workspaceId,
-      mountPath,
-      budget: mounted,
-      signal,
-    },
-  })
   try {
-    const imported = await importWorkspaceFileSnapshotProvenance({
-      workspaceId,
-      provenance: result.secretProvenance,
-      resourceId: record.id,
-      registry,
+    const result = await readWorkspaceFileMount.execute({
+      principal,
+      input: {
+        fileId: record.id,
+        assertedWorkspaceId: workspaceId,
+        mountPath,
+        budget: mounts.budget,
+        signal,
+      },
     })
-    if (!imported) registry.markIncomplete('mounted-file-provenance-unavailable')
-  } catch {
-    registry.markIncomplete('mounted-file-provenance-unavailable')
+    signal?.throwIfAborted()
+    mounts.files.push(result.mount)
+    Object.assign(mounts.budget, result.budget)
+  } catch (error) {
+    if (!(error instanceof ContentRefusedError)) throw error
+    signal?.throwIfAborted()
+    mounts.excluded.push({ path: mountPath, reason: UNVERIFIED_INPUT_REASON })
   }
-  signal?.throwIfAborted()
-  sandboxFiles.push(result.mount)
-  Object.assign(mounted, result.budget)
 }
 
 /**
@@ -226,13 +228,24 @@ async function resolveMountableWorkspaceFile(
   )
 }
 
+/** The inputs a run mounts, those it left out, and the mount budget they spent. */
+interface ResolvedInputMounts {
+  files: SandboxFile[]
+  excluded: ExcludedInput[]
+  budget: SandboxMountBudget
+}
+
+/**
+ * Resolves a run's file, directory and table inputs into mounts. Every stored item is decided by
+ * the gate the caller installed, so the run's registry learns each mounted file's secrets and a
+ * refused item is reported rather than mounted.
+ */
 export async function resolveInputFiles(
   context: ToolExecutionContext,
   inputFiles?: unknown[],
   inputTables?: unknown[],
-  inputDirectories?: unknown[],
-  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
-): Promise<SandboxFile[]> {
+  inputDirectories?: unknown[]
+): Promise<{ files: SandboxFile[]; excluded: ExcludedInput[] }> {
   const workspaceId = context.workspaceId
   if ((inputFiles?.length ?? 0) > MAX_MOUNTED_FILES) throw new Error('Too many input files')
   const organizationId = context.chatOrganizationId ?? context.organizationId
@@ -286,15 +299,18 @@ export async function resolveInputFiles(
   if (!workspaceId) {
     if (inputFiles?.length || inputTables?.length || inputDirectories?.length)
       throw new Error('An explicit workspace is required for workspace input mounts')
-    return attachments
+    return { files: attachments, excluded: [] }
   }
   const filePrincipal =
     inputFiles?.length || inputDirectories?.length
       ? resolveCopilotFilePrincipal(context)
       : undefined
-  const sandboxFiles: SandboxFile[] = [...attachments]
-  const mounted = createSandboxMountBudget()
-  mounted.buffered = attachments.reduce(
+  const mounts: ResolvedInputMounts = {
+    files: [...attachments],
+    excluded: [],
+    budget: createSandboxMountBudget(),
+  }
+  mounts.budget.buffered = attachments.reduce(
     (total, file) => total + ('content' in file ? Buffer.byteLength(file.content, 'base64') : 0),
     0
   )
@@ -326,13 +342,11 @@ export async function resolveInputFiles(
       )
       const mountPath = refField(fileRef, 'sandboxPath') ?? getSandboxWorkspaceFilePath(record)
       await pushWorkspaceFileMount(
-        sandboxFiles,
+        mounts,
         record,
         mountPath,
-        mounted,
         workspaceId,
         filePrincipal,
-        resolvedSecretTraceRegistry,
         context.abortSignal
       )
     }
@@ -395,7 +409,7 @@ export async function resolveInputFiles(
           candidate.path !== folder.path && candidate.path.startsWith(`${folder.path}/`)
       )
       if (descendants.length === 0 && childFolders.length === 0) {
-        sandboxFiles.push({ path: `${mountRoot}/.keep`, content: '' })
+        mounts.files.push({ path: `${mountRoot}/.keep`, content: '' })
         continue
       }
       for (const childFolder of childFolders) {
@@ -408,7 +422,7 @@ export async function resolveInputFiles(
         })
         if (!hasFiles) {
           const relativeFolder = childFolder.path.slice(folder.path.length).replace(/^\/+/, '')
-          sandboxFiles.push({ path: `${mountRoot}/${relativeFolder}/.keep`, content: '' })
+          mounts.files.push({ path: `${mountRoot}/${relativeFolder}/.keep`, content: '' })
         }
       }
       for (const record of descendants) {
@@ -416,13 +430,11 @@ export async function resolveInputFiles(
           record.folderPath?.slice(folder.path.length).replace(/^\/+/, '') ?? ''
         const relativePath = [relativeFolder, record.name].filter(Boolean).join('/')
         await pushWorkspaceFileMount(
-          sandboxFiles,
+          mounts,
           record,
           `${mountRoot}/${relativePath}`,
-          mounted,
           workspaceId,
           filePrincipal,
-          resolvedSecretTraceRegistry,
           context.abortSignal
         )
       }
@@ -433,25 +445,22 @@ export async function resolveInputFiles(
     for (const tableRef of inputTables) {
       const tableId = refField(tableRef, 'tableId') ?? refField(tableRef, 'path')
       if (!tableId) continue
-      if (!resolvedSecretTraceRegistry) {
-        throw new Error(
-          `Input table "${tableId}" cannot be mounted because its secret provenance is unavailable.`
-        )
-      }
       try {
         const result = await executeCopilotTableUseCase(context, readTableSnapshot, {
           workspaceId,
           reference: tableId,
           sandboxPath: refField(tableRef, 'sandboxPath'),
-          budget: mounted,
+          budget: mounts.budget,
           signal: context.abortSignal,
         })
-        if (result.unsafeProvenance)
-          resolvedSecretTraceRegistry.markIncomplete('table-snapshot-unsafe-for-mount')
-        sandboxFiles.push(result.mount)
-        Object.assign(mounted, result.budget)
+        mounts.files.push(result.mount)
+        Object.assign(mounts.budget, result.budget)
       } catch (error) {
         context.abortSignal?.throwIfAborted()
+        if (error instanceof ContentRefusedError) {
+          mounts.excluded.push({ path: tableId, reason: UNVERIFIED_INPUT_REASON })
+          continue
+        }
         logger.error('Table input mount failed', { error, tableId })
         throw new Error(
           messageForCopilotTableError(error, 'Table input could not be read. Retry the mount.')
@@ -460,7 +469,7 @@ export async function resolveInputFiles(
     }
   }
 
-  return sandboxFiles
+  return { files: mounts.files, excluded: mounts.excluded }
 }
 
 async function importMountedProvenance(
@@ -513,6 +522,8 @@ export async function executeFunctionExecute(
     'sandboxSessionKey',
     // Server-derived from resolved inputs; a model-supplied mount would skip their provenance.
     '_sandboxFiles',
+    // Stored-file mounts by raw key bypass the classified `inputs`; Chat names files by path.
+    'files',
     PRIVATE_SECRET_PROVENANCE_FIELD,
   ])
   // One persistent session sandbox per chat: files and installed packages
@@ -625,16 +636,27 @@ export async function executeFunctionExecute(
       ]
 
       if (inputFiles?.length || inputTables?.length || inputDirectories.length) {
-        const resolved = await resolveInputFiles(
-          context,
-          inputFiles,
-          inputTables,
-          inputDirectories,
-          mountedRegistry
+        /** Mounted bytes reach the run's own registry, whose output then crosses into Chat's. */
+        const resolved = await observeContentDelivery(
+          createRegistryContentGate({
+            registry: mountedRegistry,
+            workspaceId: context.workspaceId,
+            organizationId: context.chatOrganizationId ?? context.organizationId,
+            actorUserId: context.userId,
+          }),
+          () => resolveInputFiles(context, inputFiles, inputTables, inputDirectories)
         )
-        if (resolved.length > 0) {
+        if (resolved.excluded.length > 0) {
+          return {
+            success: false,
+            error:
+              'One or more requested inputs could not be mounted safely. Code was not executed.',
+            output: { codeExecuted: false, excludedInputs: resolved.excluded },
+          }
+        }
+        if (resolved.files.length > 0) {
           const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
-          enrichedParams._sandboxFiles = [...existing, ...resolved]
+          enrichedParams._sandboxFiles = [...existing, ...resolved.files]
 
           const provenance = mountedRegistry.exportProvenance()
           const bundle: PrivateSecretProvenanceBundleV1 = {
diff --git a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
index eba6b76d179..c857545957a 100644
--- a/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
+++ b/apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts
@@ -63,6 +63,12 @@ vi.mock('@/lib/mothership/vfs/resource-writer', () => ({
 
 import { functionExecuteBodySchema } from '@/lib/api/contracts'
 import * as inProcessTransport from '@/lib/api/server/routes/in-process-transport'
+import {
+  admitContent,
+  admitWrittenContent,
+  type ContentProvenance,
+  runDeclaredContentOperation,
+} from '@/lib/core/application'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import {
@@ -91,8 +97,7 @@ import {
 } from '@/lib/mothership/tools/sandbox-resources'
 import { buildMothershipSandboxSession } from '@/lib/mothership/tools/sandbox-session'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
-import { reportTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { reportWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
+import { tableOperations } from '@/lib/table/application/operations'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { buildFunctionExecuteBody, functionExecuteTool } from '@/tools/function/execute'
@@ -359,6 +364,37 @@ async function sandboxApi(path: string, handler: () => Promise<Response>, method
   })
 }
 
+/** What a sourced route does with an item it returns: admit it through the caller's gate. */
+async function deliver(
+  source: 'file' | 'table',
+  provenance: ContentProvenance,
+  value: unknown
+): Promise<boolean> {
+  const item = {
+    kind: source === 'file' ? ('workspace-file' as const) : ('table-row' as const),
+    id: 'fixture',
+    provenance,
+    view: source === 'file' ? ('complete' as const) : { derived: value },
+  }
+  const principal = createDelegatedPrincipal({
+    subjectUserId: scope.userId,
+    workspaceId: scope.workspaceId,
+  })
+  return (await admitContent(principal, [item])).admits(item)
+}
+
+const TOKEN_PROVENANCE = (): ContentProvenance => ({
+  status: 'exact',
+  entries: [
+    {
+      name: 'TOKEN',
+      encryptedValue: catalog[0].encryptedValue,
+      sourceUserId: scope.userId,
+      sourceWorkspaceId: scope.workspaceId,
+    },
+  ],
+})
+
 describe('generated workbench file provenance', () => {
   const identity = () => ({ providerId: 'e2b' as const, sandboxId: machine.sandboxId })
   const observer = () =>
@@ -554,37 +590,12 @@ describe('sandbox API provenance admission', () => {
   })
 
   it.each(['file', 'table'] as const)(
-    'imports explicit %s delivery evidence before later output',
+    'imports admitted %s delivery evidence before later output',
     async (source) => {
       const response = await sandboxApi(
         `/api/v2/${source === 'file' ? 'files/fixture' : 'tables/fixture/rows'}`,
         async () => {
-          if (source === 'file') {
-            await reportWorkspaceFileDelivery(
-              {
-                status: 'exact',
-                entries: [
-                  {
-                    name: 'TOKEN',
-                    encryptedValue: catalog[0].encryptedValue,
-                    sourceUserId: scope.userId,
-                    sourceWorkspaceId: scope.workspaceId,
-                  },
-                ],
-              },
-              'fixture'
-            )
-          } else {
-            await reportTableRowDelivery(
-              {
-                version: 1,
-                complete: true,
-                scope,
-                entries: [{ name: 'TOKEN', encryptedValue: catalog[0].encryptedValue }],
-              },
-              [{ value: canary }]
-            )
-          }
+          expect(await deliver(source, TOKEN_PROVENANCE(), canary)).toBe(true)
           return new Response(canary)
         }
       )
@@ -601,7 +612,7 @@ describe('sandbox API provenance admission', () => {
   it('accepts explicitly unrecorded file delivery and retains earlier secret history', async () => {
     await run('printf "%s" "$TOKEN" > saved.txt', ['TOKEN'])
     const response = await sandboxApi('/api/v2/files/fixture/download', async () => {
-      await reportWorkspaceFileDelivery({ status: 'unrecorded' }, 'fixture')
+      expect(await deliver('file', { status: 'unrecorded' }, 'ordinary user input')).toBe(true)
       return new Response('ordinary user input')
     })
     await machine.writeFile('/home/user/input.txt', await response.text())
@@ -615,10 +626,13 @@ describe('sandbox API provenance admission', () => {
 
   it('preserves mutation completion and withholds its body when provenance storage fails', async () => {
     const mutationPath = join(root, 'mutation.json')
+    const principal = createDelegatedPrincipal({
+      subjectUserId: scope.userId,
+      workspaceId: scope.workspaceId,
+    })
     const response = await sandboxApi(
       '/api/v2/tables/fixture/rows',
       async () => {
-        await writeFile(mutationPath, JSON.stringify({ committed: true, completed: false }))
         const evalCommand = redis.eval.bind(redis)
         vi.spyOn(redis, 'eval').mockImplementation((...args) => {
           if (String(args[2]).startsWith('mothership:workbench-provenance:v2:')) {
@@ -626,16 +640,24 @@ describe('sandbox API provenance admission', () => {
           }
           return evalCommand(...args)
         })
-        await reportTableRowDelivery(
-          {
-            version: 1,
-            complete: true,
-            scope,
-            entries: [{ name: 'TOKEN', encryptedValue: catalog[0].encryptedValue }],
+        await runDeclaredContentOperation(
+          tableOperations.createRows,
+          principal,
+          async () => {
+            await writeFile(mutationPath, JSON.stringify({ committed: true, completed: false }))
+            await admitWrittenContent(principal, [
+              {
+                kind: 'table-row',
+                id: 'fixture',
+                provenance: TOKEN_PROVENANCE(),
+                view: { derived: canary },
+              },
+            ])
           },
-          [{ value: canary }]
+          async () => {
+            await writeFile(mutationPath, JSON.stringify({ committed: true, completed: true }))
+          }
         )
-        await writeFile(mutationPath, JSON.stringify({ committed: true, completed: true }))
         return Response.json({ data: { value: canary } }, { status: 201 })
       },
       'POST'
@@ -647,27 +669,24 @@ describe('sandbox API provenance admission', () => {
     expect(response.status).toBe(502)
     const body = await response.text()
     expect(body).not.toContain(canary)
-    expect(body).toContain('completed with HTTP 201')
-    expect(body).toContain('Do not retry a mutation automatically')
+    expect(body).toContain('The change was saved')
+    expect(body).toContain('Do not retry the change')
   })
 
   it.each(['file', 'table'] as const)(
-    'preserves an explicit unknown %s delivery as unknown',
+    'refuses an unknown %s delivery and keeps the workbench usable',
     async (source) => {
-      await sandboxApi(
+      const response = await sandboxApi(
         `/api/v2/${source === 'file' ? 'files/fixture' : 'tables/fixture/rows'}`,
         async () => {
-          if (source === 'file') await reportWorkspaceFileDelivery({ status: 'unknown' }, 'fixture')
-          else
-            await reportTableRowDelivery({ version: 1, complete: false, entries: [] }, [
-              { value: 'unknown' },
-            ])
-          return new Response('unknown')
+          expect(await deliver(source, { status: 'unknown' }, 'unknown')).toBe(false)
+          return Response.json({ error: 'refused' }, { status: 403 })
         }
       )
+      expect(response.status).toBe(403)
       const result = await run('printf "ready"')
-      expect(result.projected.safe).toBe(false)
-      expect(JSON.stringify(result.projected.result)).not.toContain('ready')
+      expect(result.projected.safe).toBe(true)
+      expect(JSON.stringify(result.projected.result)).toContain('ready')
     }
   )
 })
diff --git a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts b/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts
deleted file mode 100644
index c2638090237..00000000000
--- a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.test.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
-import { isCatalogRoute } from '@/lib/mothership/tools/sandbox-catalog-routes'
-
-function routePattern(path: string): string {
-  const matched = matchV2Route(path)
-  if (!matched) throw new Error(`No v2 route matches ${path}`)
-  return matched.pattern
-}
-
-describe('isCatalogRoute', () => {
-  it.each([
-    '/api/v2/blocks',
-    '/api/v2/blocks/slack',
-    '/api/v2/tools',
-    '/api/v2/tools/slack_message',
-    '/api/v2/connector-types',
-  ])('classifies GET %s, as the route table resolves it, as catalog', (path) => {
-    expect(isCatalogRoute('GET', routePattern(path))).toBe(true)
-  })
-
-  it('does not classify data-bearing or mutating routes as catalog', () => {
-    expect(isCatalogRoute('GET', routePattern('/api/v2/logs/run-1'))).toBe(false)
-    expect(isCatalogRoute('POST', routePattern('/api/v2/tools/slack_message/execute'))).toBe(false)
-    expect(isCatalogRoute('POST', routePattern('/api/v2/tools'))).toBe(false)
-  })
-})
diff --git a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts b/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts
deleted file mode 100644
index 5f9a71d216b..00000000000
--- a/apps/sim/lib/mothership/tools/sandbox-catalog-routes.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import {
-  v2GetBlockContract,
-  v2GetToolContract,
-  v2ListBlocksContract,
-  v2ListConnectorTypesContract,
-  v2ListToolsContract,
-} from '@/lib/api/contracts/v2/catalog'
-
-/** Catalog contract paths in the generated route table's `{param}` pattern syntax. */
-const CATALOG_ROUTE_PATTERNS: ReadonlySet<string> = new Set(
-  [
-    v2ListBlocksContract,
-    v2GetBlockContract,
-    v2ListToolsContract,
-    v2GetToolContract,
-    v2ListConnectorTypesContract,
-  ].map((contract) => contract.path.replace(/\[([^\]]+)\]/g, '{$1}'))
-)
-
-/**
- * Whether a sandbox API request reads the producer-owned catalog (blocks, tools, connector
- * types): no execution output, file content, or row values, so no producer records secret
- * provenance for it and none is expected.
- */
-export function isCatalogRoute(method: string, routePattern: string): boolean {
-  return method === 'GET' && CATALOG_ROUTE_PATTERNS.has(routePattern)
-}
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
index abded34fef0..86d5dd13e03 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
@@ -6,12 +6,15 @@ import {
 import { urlsMockFns } from '@sim/testing/mocks/urls.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { isCopilotRequest } from '@/lib/api/server/routes/copilot-request'
+import {
+  type ContentSource,
+  noteContentDeliveryOperation,
+  requireAdmittedContent,
+} from '@/lib/core/application'
 import { assertWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import {
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { fileOperations } from '@/lib/workspace-files/application/operations'
 
 const { readScope, recordEffects, fetcher, routeMatcher, recordInput, mint } = vi.hoisted(() => ({
   readScope: vi.fn(),
@@ -259,7 +262,7 @@ vi.mock('@/lib/execution/remote-sandbox/session-file-provenance', () => ({
   recordExistingSessionFileInput: recordInput,
 }))
 
-it('does not poison public scratch after authenticated static catalog discovery', async () => {
+it('records nothing into the workbench for a route that returns no stored content', async () => {
   routeMatcher.mockReturnValue({
     params: { toolId: 'function_execute' },
     load: async () => ({ GET: fetcher }),
@@ -270,25 +273,34 @@ it('does not poison public scratch after authenticated static catalog discovery'
   expect(recordInput).not.toHaveBeenCalled()
 })
 
-it('cannot deliver a successful unclassified file response when recording its unknown provenance fails', async () => {
+const CHAT = createDelegatedPrincipal({ serviceId: 'copilot' })
+const fileSource = (provenance: ContentSource['provenance']): ContentSource => ({
+  kind: 'workspace-file',
+  id: 'file',
+  provenance,
+  view: 'complete',
+})
+
+it('replaces a successful response its sourced operation never classified with a 403', async () => {
   routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
-  fetcher.mockResolvedValue(new Response('unsafe'))
-  recordInput.mockRejectedValueOnce(new Error('storage unavailable'))
-  await expect(proxySandboxResourceRequest(request('/api/v2/files/file'), token)).rejects.toThrow(
-    'storage unavailable'
-  )
-  expect(fetcher).toHaveBeenCalledOnce()
+  fetcher.mockImplementation(async () => {
+    noteContentDeliveryOperation(fileOperations.readContent, CHAT)
+    return new Response('unclassified file text')
+  })
+  const response = await proxySandboxResourceRequest(request('/api/v2/files/file/text'), token)
+  expect(response.status).toBe(403)
+  expect(await response.text()).not.toContain('unclassified file text')
+  expect(recordInput).not.toHaveBeenCalled()
 })
 
 /**
- * The file read and download use cases refuse a Chat principal that no delivery observer records,
- * so the workbench's file reads depend on this proxy installing one around the route handler.
+ * The file read and download use cases refuse a Chat principal no gate observes, so the
+ * workbench's reads depend on this proxy installing its session gate around the route handler.
  */
-it('dispatches a workbench file read under a delivery observer the Copilot guard admits', async () => {
+it('admits a workbench file read under the session gate, recording it before the bytes return', async () => {
   routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
   fetcher.mockImplementation(async () => {
-    requireCopilotWorkspaceFileDeliveryObserver(createDelegatedPrincipal({ serviceId: 'copilot' }))
-    await reportWorkspaceFileDelivery({ status: 'exact', entries: [] }, 'file')
+    await requireAdmittedContent(CHAT, fileSource({ status: 'exact', entries: [] }))
     return new Response('file text')
   })
   recordInput.mockResolvedValueOnce(undefined)
@@ -300,6 +312,23 @@ it('dispatches a workbench file read under a delivery observer the Copilot guard
 
   expect(response.status).toBe(200)
   expect(await response.text()).toBe('file text')
+  expect(recordInput).toHaveBeenCalledWith(chatSandboxSessionKey(scope.chatId), {
+    status: 'exact',
+    entries: [],
+  })
+})
+
+it('withholds a result whose provenance the workbench history could not record', async () => {
+  routeMatcher.mockReturnValue({ params: { fileId: 'file' }, load: async () => ({ GET: fetcher }) })
+  fetcher.mockImplementation(async () => {
+    await requireAdmittedContent(CHAT, fileSource({ status: 'exact', entries: [] }))
+    return new Response('file text')
+  })
+  recordInput.mockRejectedValueOnce(new Error('storage unavailable'))
+  const response = await proxySandboxResourceRequest(request('/api/v2/files/file/text'), token)
+  expect(response.status).toBe(502)
+  expect(await response.text()).not.toContain('file text')
+  expect(fetcher).toHaveBeenCalledOnce()
 })
 
 vi.mock('@/lib/mothership/chat/delegation', () => ({ mintDelegationToken: mint }))
diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
index b217859994a..b6361660268 100644
--- a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
+++ b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -1,49 +1,29 @@
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { LRUCache } from 'lru-cache'
 import { NextRequest } from 'next/server'
-import { v2DownloadFileContract, v2ReadFileTextContract } from '@/lib/api/contracts/v2/files'
 import { markCopilotRequest } from '@/lib/api/server/routes/copilot-request'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
+import { ContentGateFailure } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
-import {
-  type DurableSecretProvenance,
-  durableSecretProvenanceFromEnvelope,
-  EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
-  mergeDurableSecretProvenance,
-} from '@/lib/execution/durable-secret-provenance'
-import { reportDurableSecretProvenanceUnrecorded } from '@/lib/execution/durable-secret-provenance-telemetry'
-import { recordExistingSessionFileInput } from '@/lib/execution/remote-sandbox/session-file-provenance'
 import { createResourceEffectTransport } from '@/lib/mothership/agent-cli/resource-effects'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
+import {
+  createSessionContentGate,
+  dispatchUnderContentGate,
+  markCommittedWriteResponse,
+  WorkbenchProvenanceUnavailableError,
+} from '@/lib/mothership/content-delivery'
 import type { ResourceChange } from '@/lib/mothership/generated/resources'
-import { isCatalogRoute } from '@/lib/mothership/tools/sandbox-catalog-routes'
 import {
   readSandboxResourceScope,
   recordSandboxResourceEffects,
 } from '@/lib/mothership/tools/sandbox-resources'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 
 const logger = createLogger('MothershipSandboxResourceTransport')
 
-/** How long one route's missing-provenance report suppresses repeats for that route. */
-const UNRECORDED_PROVENANCE_LOG_WINDOW_MS = 60 * 60 * 1000
-/** Memory backstop above the number of `method route` pairs the v2 route table can produce. */
-const UNRECORDED_PROVENANCE_LOG_MAX_ROUTES = 1_000
-
-/**
- * Data-bearing routes already reported as lacking a provenance producer. The gap is a
- * property of the route, not the request, so it is reported once per route per window.
- */
-const unrecordedProvenanceRoutesLogged = new LRUCache<string, true>({
-  max: UNRECORDED_PROVENANCE_LOG_MAX_ROUTES,
-  ttl: UNRECORDED_PROVENANCE_LOG_WINDOW_MS,
-})
-
 /** Private callback observes the real authenticated v2 request without changing its body or API contract. */
 export async function proxySandboxResourceRequest(
   request: Request,
@@ -117,7 +97,6 @@ async function proxyAuthorizedSandboxRequest(
   const forwarded = new Request(target, init)
   const effects: ResourceChange[] = []
   let response: Response | undefined
-  let rowProvenance: DurableSecretProvenance | undefined
   let dispatched = false
   /** Invoke the same handler with private request identity; the declared use case still authorizes current domain access. */
   const matched = matchV2Route(path)
@@ -139,61 +118,37 @@ async function proxyAuthorizedSandboxRequest(
     if (!(result instanceof Response)) throw new Error('Invalid sandbox API response')
     return result
   }
-  const recordInput = (provenance: boolean | DurableSecretProvenance) =>
-    recordExistingSessionFileInput(chatSandboxSessionKey(scope.chatId), provenance)
-  const fileRead =
-    method === 'GET' &&
-    [v2DownloadFileContract, v2ReadFileTextContract].some(
-      (contract) =>
-        contract.path.replace(/\[([^\]]+)\]/g, (_match, key) =>
-          encodeURIComponent(matched.params[key] ?? '')
-        ) === path
-    )
+  const gate = createSessionContentGate({
+    sessionKey: chatSandboxSessionKey(scope.chatId),
+    workspaceId: targetWorkspaceId,
+    actorUserId: scope.userId,
+  })
   const deliver = async () => {
     dispatched = true
-    let fileObserved = false
-    const result = await observeTableRowDelivery(
-      async (provenance, _values, extras) => {
-        rowProvenance = mergeDurableSecretProvenance(
-          rowProvenance ?? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE,
-          extras.unprovenancedErrorText
-            ? { status: 'unknown' }
-            : durableSecretProvenanceFromEnvelope(provenance)
-        )
-      },
-      () =>
-        observeWorkspaceFileDelivery(async (provenance) => {
-          if (provenance?.status === 'unrecorded') {
-            reportDurableSecretProvenanceUnrecorded({
-              surface: 'workspace-file',
-              workspaceId: targetWorkspaceId,
-              actorUserId: scope.userId,
-            })
-          }
-          await recordInput(provenance?.status === 'unrecorded' ? true : (provenance ?? false))
-          fileObserved = true
-        }, dispatch)
-    )
     try {
-      if (fileRead && !fileObserved && result.ok && result.body) await recordInput(false)
-      else if (!fileObserved && !rowProvenance && !isCatalogRoute(method, matched.pattern)) {
-        /** Missing producer evidence is unrecorded, not proof that the machine received a secret. */
-        const routeKey = `${method} ${matched.pattern}`
-        if (!unrecordedProvenanceRoutesLogged.has(routeKey)) {
-          unrecordedProvenanceRoutesLogged.set(routeKey, true)
-          logger.warn('Sandbox API response has no recorded secret provenance', {
-            method,
-            route: matched.pattern,
-            toolCallId: scope.toolCallId,
-          })
-        }
-      }
+      response = (await dispatchUnderContentGate(gate, dispatch)).response
     } catch (error) {
-      await result.body?.cancel().catch(() => {})
-      throw error
+      if (
+        !(error instanceof ContentGateFailure) ||
+        !(error.gateFailure instanceof WorkbenchProvenanceUnavailableError)
+      ) {
+        throw error
+      }
+      /** A mutation may already have committed; the result is withheld, never retried for it. */
+      logger.warn('Sandbox response provenance could not be recorded', {
+        toolCallId: scope.toolCallId,
+      })
+      const withheld = Response.json(
+        {
+          error: error.committedWrite
+            ? 'The change was saved, but its result could not be returned safely. Do not retry the change.'
+            : 'The API request ran, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.',
+        },
+        { status: 502 }
+      )
+      response = error.committedWrite ? markCommittedWriteResponse(withheld) : withheld
     }
-    response = result
-    return result
+    return response
   }
   try {
     await createResourceEffectTransport(endpoint, deliver, effects)(forwarded)
@@ -240,24 +195,6 @@ async function proxyAuthorizedSandboxRequest(
       }
     })
   )
-  if (rowProvenance) {
-    // Row mutations have already committed; admission must not interrupt completion or effects.
-    try {
-      await recordInput(rowProvenance)
-    } catch {
-      await response.body?.cancel().catch(() => {})
-      logger.warn('Sandbox response provenance could not be recorded after API completion', {
-        toolCallId: scope.toolCallId,
-        status: response.status,
-      })
-      response = Response.json(
-        {
-          error: `API request completed with HTTP ${response.status}, but its result could not be returned safely. Do not retry a mutation automatically; read the resource to check its current state.`,
-        },
-        { status: 502 }
-      )
-    }
-  }
   return new Response(request.method === 'HEAD' ? null : response.body, {
     status: response.status,
     statusText: response.statusText,
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
index 642253772e9..0e1b68beeee 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.test.ts
@@ -8,7 +8,9 @@ const {
   readWorkspaceFileContentMock,
   readWorkspaceFileMetadataMock,
   storeCompiledDocMock,
+  runSandboxTaskMock,
 } = vi.hoisted(() => ({
+  runSandboxTaskMock: vi.fn(),
   loadCompiledDocMock: vi.fn(),
   publishCompiledDocArtifactMock: vi.fn(),
   readWorkspaceFileContentMock: vi.fn(),
@@ -26,13 +28,17 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => (
 vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () => ({
   readWorkspaceFileMetadata: { execute: readWorkspaceFileMetadataMock },
 }))
-vi.mock('./doc-compiled-store', () => ({
+vi.mock('@/lib/execution/sandbox/run-task', () => ({ runSandboxTask: runSandboxTaskMock }))
+vi.mock('@/lib/workspace-files/compiled-document-store', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/workspace-files/compiled-document-store')>()),
   loadCompiledDoc: loadCompiledDocMock,
   loadPublishedCompiledDoc: vi.fn(),
   publishCompiledDocArtifact: publishCompiledDocArtifactMock,
   storeCompiledDoc: storeCompiledDocMock,
 }))
 
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { collectReferencedFileIds, compileDoc } from './doc-compile'
 
 const executeInSandboxMock = remoteSandboxMockFns.mockExecuteInSandbox
@@ -246,3 +252,78 @@ describe('collectReferencedFileIds', () => {
     )
   })
 })
+
+describe('isolated-VM compile for Chat', () => {
+  beforeEach(() => {
+    setEnvFlags({ isDocSandboxEnabled: false })
+  })
+
+  it('rebuilds a cached build that read an older version of a file it names', async () => {
+    const chat = createCopilotChatFilePrincipal({
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+      chatId: 'chat-1',
+    })
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    const version = (at: string) => {
+      const contentUpdatedAt = new Date(at)
+      return {
+        id: ID,
+        workspaceId: 'workspace-1',
+        name: 'reference.png',
+        key: `workspace/workspace-1/${ID}-reference.png`,
+        path: '/api/files/serve/reference.png',
+        size: 10,
+        type: 'image/png',
+        uploadedBy: 'user-1',
+        uploadedAt: contentUpdatedAt,
+        updatedAt: contentUpdatedAt,
+        contentUpdatedAt,
+        storageContext: 'workspace' as const,
+      }
+    }
+    runSandboxTaskMock.mockImplementation(
+      async (
+        _task: string,
+        _input: unknown,
+        options: { onWorkspaceFileAccess?: (identity: unknown) => void }
+      ) => {
+        const { file } = await readWorkspaceFileMetadataMock()
+        options.onWorkspaceFileAccess?.({
+          fileId: ID,
+          key: file.key,
+          context: 'workspace',
+          contentUpdatedAt: file.contentUpdatedAt,
+        })
+        return Buffer.from('%PDF-built')
+      }
+    )
+    const compile = () =>
+      observeContentDelivery(admitAll, () =>
+        compileDoc({
+          source: `image = await getFileBase64('${ID}') // cache-version`,
+          fileName: 'report.pdf',
+          workspaceId: 'workspace-1',
+          filePrincipal: chat,
+        })
+      )
+    readWorkspaceFileMetadataMock.mockResolvedValue({
+      file: version('2026-08-05T00:00:00.000Z'),
+      share: null,
+    })
+    await compile()
+    await compile()
+    expect(runSandboxTaskMock).toHaveBeenCalledOnce()
+
+    readWorkspaceFileMetadataMock.mockResolvedValue({
+      file: version('2026-08-06T00:00:00.000Z'),
+      share: null,
+    })
+    await compile()
+    expect(runSandboxTaskMock).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
index 030128fe095..5224b4acb61 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-compile.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
+import { ContentRefusedError, mustClassifyContent } from '@/lib/core/application'
 import { isDocSandboxEnabled } from '@/lib/core/config/env-flags'
 import { CodeLanguage } from '@/lib/execution/languages'
 import {
@@ -10,17 +11,20 @@ import {
 } from '@/lib/execution/remote-sandbox'
 import { runSandboxTask } from '@/lib/execution/sandbox/run-task'
 import { DocCompileUserError } from '@/lib/mothership/tools/server/files/doc-compile-error'
+import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
+import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { admitWorkspaceFiles } from '@/lib/workspace-files/application/admit-file-content'
+import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
+import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
 import {
   type CompiledDocReadOptions,
   loadCompiledDoc,
   loadPublishedCompiledDoc,
+  COMPILED_PDF_MAGIC as PDF_MAGIC,
   publishCompiledDocArtifact,
   storeCompiledDoc,
-} from '@/lib/mothership/tools/server/files/doc-compiled-store'
-import { PPTX_SHIM_JS } from '@/lib/mothership/tools/server/files/pptx-shim'
-import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
-import { readWorkspaceFileMetadata } from '@/lib/workspace-files/application/read-workspace-file-metadata'
+  COMPILED_ZIP_MAGIC as ZIP_MAGIC,
+} from '@/lib/workspace-files/compiled-document-store'
 import { getContentType } from '@/app/api/files/utils'
 import type { SandboxTaskId } from '@/sandbox-tasks/registry'
 
@@ -217,6 +221,14 @@ async function resolveReferencedImages(
       `More than ${MAX_REFERENCED_INPUTS} referenced input files; maximum is ${MAX_REFERENCED_INPUTS}. Reference fewer files.`
     )
   }
+  return resolveReferencedFileIds(workspaceId, principal, ids)
+}
+
+async function resolveReferencedFileIds(
+  workspaceId: string,
+  principal: Principal,
+  ids: ReadonlySet<string>
+): Promise<ReferencedImageResolution> {
   if (ids.size === 0) {
     return { images: [], referenceCount: 0 }
   }
@@ -344,6 +356,8 @@ interface LegacyCompileArgs {
   workspaceId: string
   ownerKey?: string
   signal?: AbortSignal
+  /** Who the compile reads for; absent for a server render that serves no principal's view. */
+  filePrincipal?: Principal
 }
 
 interface CompileArgs extends LegacyCompileArgs {
@@ -652,15 +666,29 @@ interface CompilableFormat {
   contentType: string
 }
 
-const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04])
-const PDF_MAGIC = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2d])
-
 const COMPILABLE_FORMATS: Record<string, CompilableFormat> = {
   '.pptx': { magic: ZIP_MAGIC, taskId: 'pptx-generate', contentType: PPTX_MIME },
   '.docx': { magic: ZIP_MAGIC, taskId: 'docx-generate', contentType: DOCX_MIME },
   '.pdf': { magic: PDF_MAGIC, taskId: 'pdf-generate', contentType: PDF_MIME },
 }
 
+/** Whether a cached build read exactly the versions this compile admitted, and nothing else. */
+function cachedFromAdmittedVersions(
+  contributors: readonly WorkspaceFileSecretProvenanceIdentity[],
+  admitted: ReadonlyMap<string, ResolvedReferencedImage['record']>
+): boolean {
+  return contributors.every((contributor) => {
+    const record = admitted.get(contributor.fileId)
+    return (
+      record !== undefined &&
+      record.key === contributor.key &&
+      (record.storageContext ?? 'workspace') === contributor.context &&
+      (record.contentUpdatedAt ?? record.updatedAt).getTime() ===
+        contributor.contentUpdatedAt?.getTime()
+    )
+  })
+}
+
 async function compileDocInLegacySandbox(
   args: LegacyCompileArgs,
   fmt: E2BDocFormat
@@ -677,7 +705,29 @@ async function compileDocInLegacySandbox(
 
   const cacheKey = sha256Hex(`.${fmt.ext}${args.source}${args.workspaceId}`)
   const cached = compiledDocCache.get(cacheKey)
-  if (cached) {
+  let cacheReadable = true
+  if (cached && args.filePrincipal && mustClassifyContent(args.filePrincipal)) {
+    const { images } = await resolveReferencedFileIds(
+      args.workspaceId,
+      args.filePrincipal,
+      new Set(cached.contributingFiles?.map((file) => file.fileId))
+    )
+    const records = images.map((image) => image.record)
+    cacheReadable = cachedFromAdmittedVersions(
+      cached.contributingFiles ?? [],
+      new Map(records.map((file) => [file.id, file]))
+    )
+    if (cacheReadable) {
+      const admitted = await admitWorkspaceFiles(
+        args.filePrincipal,
+        args.workspaceId,
+        records,
+        'complete'
+      )
+      if (admitted.length !== records.length) throw new ContentRefusedError('workspace-file')
+    }
+  }
+  if (cached && cacheReadable) {
     return {
       buffer: cached.buffer,
       contentType: fmt.contentType,
@@ -698,6 +748,7 @@ async function compileDocInLegacySandbox(
     {
       ownerKey: args.ownerKey,
       signal: args.signal,
+      filePrincipal: args.filePrincipal,
       onWorkspaceFileAccess: (identity) => {
         contributingFiles.set(`${identity.context}:${identity.fileId}:${identity.key}`, identity)
       },
@@ -715,8 +766,8 @@ async function compileDocInLegacySandbox(
 /**
  * Returns the compiled binary for a document. The remote backend reuses and publishes a
  * dependency-bound artifact after statically staging its inputs. The isolated-VM backend preserves
- * its live-broker semantics and keeps only a small process-local cache; it cannot publish a durable
- * artifact until broker calls can report the exact file versions they accessed.
+ * its live-broker semantics and keeps a small process-local cache bound to the actual file revisions
+ * read by its brokers. Each broker read is authorized and admitted before returning bytes.
  */
 export async function compileDoc(args: CompileArgs): Promise<CompiledDocResult> {
   const { source, fileName, workspaceId } = args
@@ -942,7 +993,10 @@ export async function resolveServableDocBytes(args: {
     if (!isDocSandboxEnabled) {
       const fmt = await getE2BDocFormat(fileName)
       if (!fmt) throw new Error(`Unsupported document format: ${fileName}`)
-      return compileDocInLegacySandbox({ source, fileName, workspaceId, ownerKey, signal }, fmt)
+      return compileDocInLegacySandbox(
+        { source, fileName, workspaceId, ownerKey, signal, filePrincipal },
+        fmt
+      )
     }
     const referencedFileIds = collectReferencedFileIds(source)
     if (referencedFileIds.size > 0) {
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts b/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
index d2207e71c94..5f8eaf10d8c 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
+++ b/apps/sim/lib/mothership/tools/server/files/doc-servable.test.ts
@@ -33,7 +33,8 @@ vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => (
 vi.mock('@/lib/workspace-files/application/read-workspace-file-metadata', () => ({
   readWorkspaceFileMetadata: { execute: mockReadWorkspaceFileMetadata },
 }))
-vi.mock('./doc-compiled-store', () => ({
+vi.mock('@/lib/workspace-files/compiled-document-store', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/lib/workspace-files/compiled-document-store')>()),
   loadCompiledDoc: mockLoadCompiledDoc,
   loadPublishedCompiledDoc: mockLoadPublishedCompiledDoc,
   publishCompiledDocArtifact: mockPublishCompiledDocArtifact,
@@ -48,8 +49,12 @@ vi.mock('@/app/api/files/utils', () => ({
         : 'application/octet-stream',
 }))
 
+import {
+  compileDoc,
+  resolveServableDoc,
+  resolveServableDocBytes,
+} from '@/lib/mothership/tools/server/files/doc-compile'
 import { DocCompileUserError } from '@/lib/mothership/tools/server/files/doc-compile-error'
-import { compileDoc, resolveServableDoc, resolveServableDocBytes } from './doc-compile'
 
 const { mockExecuteInSandbox } = remoteSandboxMockFns
 
diff --git a/apps/sim/lib/mothership/tools/server/files/file-preview.ts b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
index 55ec225c7f7..d97093614e8 100644
--- a/apps/sim/lib/mothership/tools/server/files/file-preview.ts
+++ b/apps/sim/lib/mothership/tools/server/files/file-preview.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import { observeContentOutsideModel } from '@/lib/core/application'
 import { executeCopilotFileUseCase } from '@/lib/mothership/application/execute-file-use-case'
 import type { ExecutionContext } from '@/lib/mothership/request/types'
 import { readWorkspaceFileContent } from '@/lib/workspace-files/application/read-workspace-file-content'
@@ -139,15 +140,18 @@ export async function loadWorkspaceFileTextForPreview(
   fileId: string
 ): Promise<WorkspaceFilePreviewBase | undefined> {
   try {
-    const { content: buffer } = await executeCopilotFileUseCase(
-      context,
-      readWorkspaceFileContent,
-      {
-        fileId,
-        assertedWorkspaceId: workspaceId,
-        maxBytes: MAX_PREVIEW_SOURCE_BYTES,
-      },
-      { fileId }
+    /** The preview streams to the user's own editor, never to the model. */
+    const { content: buffer } = await observeContentOutsideModel(() =>
+      executeCopilotFileUseCase(
+        context,
+        readWorkspaceFileContent,
+        {
+          fileId,
+          assertedWorkspaceId: workspaceId,
+          maxBytes: MAX_PREVIEW_SOURCE_BYTES,
+        },
+        { fileId }
+      )
     )
     return {
       text: buffer.toString('utf-8'),
diff --git a/apps/sim/lib/mothership/tools/server/files/workspace-file.ts b/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
index f9c861b63a1..924356b1b1b 100644
--- a/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
+++ b/apps/sim/lib/mothership/tools/server/files/workspace-file.ts
@@ -248,7 +248,11 @@ export async function compileDocForWrite(args: {
 
   if (docInfo.isDoc) {
     try {
-      await runSandboxTask(docInfo.taskId!, { code: source, workspaceId }, { ownerKey, signal })
+      await runSandboxTask(
+        docInfo.taskId!,
+        { code: source, workspaceId },
+        { ownerKey, signal, filePrincipal: principal }
+      )
     } catch (err) {
       return {
         ok: false,
diff --git a/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts b/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
index 23b28808d78..58391d34b22 100644
--- a/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
+++ b/apps/sim/lib/mothership/tools/server/image/generate-image.test.ts
@@ -55,7 +55,6 @@ import { generateImageServerTool } from '@/lib/mothership/tools/server/image/gen
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
 const { mockResolveWorkspaceFileReference } = workspaceFileReferenceMockFns
 workspaceFileSecretProvenanceMockFns.mockCreateWorkspaceFileSecretProvenanceFromRegistry.mockImplementation(
   async () => ({ safe: true, provenance: { status: 'exact', entries: [] } })
@@ -106,7 +105,6 @@ function generate(paths: string[]) {
 
 describe('generate_image reference images', () => {
   beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
     mockResolveWorkspaceFileReference.mockResolvedValue(chatUpload)
     mockReadWorkspaceFileContent.mockResolvedValue({
       file: chatUpload,
@@ -207,19 +205,4 @@ describe('generate_image reference images', () => {
     )
     expect(mockGenerateContent).not.toHaveBeenCalled()
   })
-
-  it('still refuses a model-unsafe reference with the safety message', async () => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-    const result = await generate(['uploads/face.png'])
-
-    expect(result).toEqual(
-      expect.objectContaining({
-        success: false,
-        message: expect.stringContaining('cannot be sent'),
-      })
-    )
-    expect(mockReadWorkspaceFileContent).not.toHaveBeenCalled()
-    expect(mockGenerateContent).not.toHaveBeenCalled()
-  })
 })
diff --git a/apps/sim/lib/mothership/tools/server/image/generate-image.ts b/apps/sim/lib/mothership/tools/server/image/generate-image.ts
index f1faadc2135..096e4f63dc4 100644
--- a/apps/sim/lib/mothership/tools/server/image/generate-image.ts
+++ b/apps/sim/lib/mothership/tools/server/image/generate-image.ts
@@ -15,7 +15,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -83,7 +82,7 @@ async function loadReferenceImage(
     }
     throw error
   }
-  await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file })
+
   try {
     const { content } = await executeCopilotFileUseCase(
       context,
@@ -92,6 +91,7 @@ async function loadReferenceImage(
         fileId: file.id,
         assertedWorkspaceId: workspaceId,
         maxBytes: MAX_MEDIA_BYTES,
+        contentView: 'opaque',
       },
       { fileId: file.id }
     )
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
index 77c2bea3b06..62c26086625 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.test.ts
@@ -28,6 +28,8 @@ vi.mock('@/lib/mothership/application/execute-file-use-case', () => ({
   executeCopilotFileUseCase: async () => ({
     file,
     content: await workspaceFileManagerMockFns.mockFetchWorkspaceFileBuffer(file),
+    secretProvenance:
+      await workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance(),
   }),
   resolveCopilotWorkspaceFileReference: (...args: unknown[]) =>
     workspaceFileManagerMockFns.mockResolveWorkspaceFileReference(...args),
@@ -253,22 +255,6 @@ describe('ffmpeg server tool secret provenance', () => {
     })
   })
 
-  it('does not expose storage errors after learning that an input has tracked provenance', async () => {
-    getBoundWorkspaceFileSecretProvenanceMock.mockResolvedValue(TRACKED)
-    fetchWorkspaceFileBufferMock.mockRejectedValue(new Error('storage echoed private bytes'))
-
-    const result = await ffmpegServerTool.execute(
-      { operation: 'convert', inputs: { files: [{ path: 'files/input.mp4' }] } },
-      context
-    )
-
-    expect(result).toEqual({
-      success: false,
-      message: 'ffmpeg convert failed: The media operation failed safely',
-    })
-    expect(runFfmpegOperationMock).not.toHaveBeenCalled()
-  })
-
   it('projects dynamic parser errors before returning them', async () => {
     const secret = 'decoder-secret'
     const errorRegistry = new ResolvedSecretTraceRegistry([
diff --git a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
index dc86c213bc7..aa13ad4258b 100644
--- a/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
+++ b/apps/sim/lib/mothership/tools/server/media/ffmpeg.ts
@@ -1,5 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { observeContentOutsideModel } from '@/lib/core/application'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { MAX_MEDIA_BYTES } from '@/lib/media/falai'
 import { type FfmpegOperation, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
 import { FFMPEG_LIMITS } from '@/lib/media/ffmpeg-limits'
@@ -16,7 +18,6 @@ import {
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import {
   createWorkspaceFileSecretProvenanceFromRegistry,
-  getBoundWorkspaceFileSecretProvenance,
   mergeWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -133,23 +134,27 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         if (totalInputBytes + fileRecord.size > MAX_MEDIA_BYTES) {
           throw new Error(`Input files exceed the ${MAX_MEDIA_BYTES} byte limit`)
         }
-        const fileProvenance = await getBoundWorkspaceFileSecretProvenance(workspaceId, {
-          fileId: fileRecord.id,
-          key: fileRecord.key,
-          context: fileRecord.storageContext ?? 'workspace',
-        })
+        /** The output file carries every input's provenance, merged below; no input reaches a model. */
+        const {
+          file,
+          content: buffer,
+          secretProvenance,
+        } = await observeContentOutsideModel(() =>
+          executeCopilotFileUseCase(
+            context,
+            readWorkspaceFileContent,
+            {
+              fileId: fileRecord.id,
+              assertedWorkspaceId: workspaceId,
+              maxBytes: MAX_MEDIA_BYTES,
+              includeSecretProvenance: true,
+            },
+            { fileId: fileRecord.id }
+          )
+        )
+        const fileProvenance = secretProvenance ?? { status: 'unknown' as const }
         inputRequiresOpaqueError ||=
           fileProvenance.status !== 'exact' || fileProvenance.entries.length > 0
-        const { content: buffer } = await executeCopilotFileUseCase(
-          context,
-          readWorkspaceFileContent,
-          {
-            fileId: fileRecord.id,
-            assertedWorkspaceId: workspaceId,
-            maxBytes: MAX_MEDIA_BYTES,
-          },
-          { fileId: fileRecord.id }
-        )
         totalInputBytes += buffer.length
         if (totalInputBytes > MAX_MEDIA_BYTES) {
           throw new Error(`Input files exceed the ${MAX_MEDIA_BYTES} byte limit`)
@@ -157,8 +162,8 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         inputProvenances.push(fileProvenance)
         mediaFiles.push({
           buffer,
-          mimeType: fileRecord.type || 'application/octet-stream',
-          name: fileRecord.name,
+          mimeType: file.type || 'application/octet-stream',
+          name: file.name,
         })
       }
 
@@ -241,7 +246,8 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
         downloadUrl: written.downloadUrl,
       }
     } catch (error) {
-      const errorMessage = getErrorMessage(error, '')
+      const errorMessage =
+        asOrchestrationError(error)?.code === 'internal' ? '' : getErrorMessage(error, '')
       const projection = inputRequiresOpaqueError
         ? undefined
         : errorMessage
diff --git a/apps/sim/lib/mothership/tools/server/media/generate-audio.ts b/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
index 9c1caa7507b..44afdb84f96 100644
--- a/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
+++ b/apps/sim/lib/mothership/tools/server/media/generate-audio.ts
@@ -13,7 +13,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -99,11 +98,16 @@ export const generateAudioServerTool: BaseServerTool<GenerateAudioArgs, Generate
             reference: samplePath,
           }
         )
-        await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file: sample })
+
         const { content: sampleBuffer } = await executeCopilotFileUseCase(
           context,
           readWorkspaceFileContent,
-          { fileId: sample.id, assertedWorkspaceId: workspaceId, maxBytes: MAX_MEDIA_BYTES },
+          {
+            fileId: sample.id,
+            assertedWorkspaceId: workspaceId,
+            maxBytes: MAX_MEDIA_BYTES,
+            contentView: 'opaque',
+          },
           { fileId: sample.id }
         )
         const sampleMime = sample.type || 'audio/mpeg'
diff --git a/apps/sim/lib/mothership/tools/server/media/generate-video.ts b/apps/sim/lib/mothership/tools/server/media/generate-video.ts
index efa11178bdf..95bfed86039 100644
--- a/apps/sim/lib/mothership/tools/server/media/generate-video.ts
+++ b/apps/sim/lib/mothership/tools/server/media/generate-video.ts
@@ -13,7 +13,6 @@ import {
   type BaseServerTool,
   type ServerToolContext,
 } from '@/lib/mothership/tools/server/base-tool'
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/mothership/vfs/resource-writer'
 import { createWorkspaceFileSecretProvenanceFromRegistry } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -76,7 +75,7 @@ export const generateVideoServerTool: BaseServerTool<GenerateVideoArgs, Generate
             reference: refPath,
           }
         )
-        await assertOpaqueWorkspaceFileModelSafe({ workspaceId, file: fileRecord })
+
         const { content: buffer } = await executeCopilotFileUseCase(
           context,
           readWorkspaceFileContent,
@@ -84,6 +83,7 @@ export const generateVideoServerTool: BaseServerTool<GenerateVideoArgs, Generate
             fileId: fileRecord.id,
             assertedWorkspaceId: workspaceId,
             maxBytes: MAX_MEDIA_BYTES,
+            contentView: 'opaque',
           },
           { fileId: fileRecord.id }
         )
diff --git a/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts b/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
index c01c6f50fb3..6405fae671f 100644
--- a/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
+++ b/apps/sim/lib/mothership/tools/server/media/model-boundaries.test.ts
@@ -1,11 +1,4 @@
-import {
-  workspaceFileReferenceMock,
-  workspaceFileReferenceMockFns,
-} from '@sim/testing/mocks/workspace-file-reference.mock'
-import {
-  workspaceFileSecretProvenanceMock,
-  workspaceFileSecretProvenanceMockFns,
-} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
+import { workspaceFileSecretProvenanceMock } from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { observeServiceCosts } from '@/lib/mothership/billing/service-observer'
 
@@ -13,17 +6,13 @@ const {
   mockGenerateContent,
   mockGenerateFalAudio,
   mockGenerateFalVideo,
-  mockReadWorkspaceFileContent,
   mockWriteWorkspaceFileByPath,
 } = vi.hoisted(() => ({
   mockGenerateContent: vi.fn(),
   mockGenerateFalAudio: vi.fn(),
   mockGenerateFalVideo: vi.fn(),
-  mockReadWorkspaceFileContent: vi.fn(),
   mockWriteWorkspaceFileByPath: vi.fn(),
 }))
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
-const { mockResolveWorkspaceFileReference } = workspaceFileReferenceMockFns
 
 vi.mock('@google/genai', () => ({
   GoogleGenAI: class GoogleGenAI {
@@ -36,13 +25,6 @@ vi.mock('@/lib/mothership/vfs/resource-writer', () => ({
 }))
 vi.mock('@/lib/media/falai-audio', () => ({ generateFalAudio: mockGenerateFalAudio }))
 vi.mock('@/lib/media/falai-video', () => ({ generateFalVideo: mockGenerateFalVideo }))
-vi.mock(
-  '@/lib/workspace-files/application/resolve-workspace-file-reference',
-  () => workspaceFileReferenceMock
-)
-vi.mock('@/lib/workspace-files/application/read-workspace-file-content', () => ({
-  readWorkspaceFileContent: { execute: mockReadWorkspaceFileContent },
-}))
 vi.mock(
   '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
   () => workspaceFileSecretProvenanceMock
@@ -54,20 +36,6 @@ import { generateAudioServerTool } from '@/lib/mothership/tools/server/media/gen
 import { generateVideoServerTool } from '@/lib/mothership/tools/server/media/generate-video'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
-const file = {
-  id: 'file-1',
-  workspaceId: 'workspace-1',
-  name: 'reference.png',
-  key: 'workspace/workspace-1/reference.png',
-  path: '/api/files/serve/reference.png',
-  size: 10,
-  type: 'image/png',
-  uploadedBy: 'user-1',
-  uploadedAt: new Date('2026-08-05T00:00:00.000Z'),
-  updatedAt: new Date('2026-08-05T00:00:00.000Z'),
-  storageContext: 'workspace' as const,
-}
-
 function contextWithSecrets(
   entries: Array<{ name: string; plaintext: string }>
 ): ServerToolContext {
@@ -86,9 +54,6 @@ function contextWithSecrets(
 
 describe('Mothership media model boundaries', () => {
   beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
-    mockResolveWorkspaceFileReference.mockResolvedValue(file)
-    mockReadWorkspaceFileContent.mockResolvedValue({ file, content: Buffer.from('opaque-media') })
     mockWriteWorkspaceFileByPath.mockResolvedValue({
       id: 'output-1',
       name: 'output.bin',
@@ -184,48 +149,4 @@ describe('Mothership media model boundaries', () => {
       expect.objectContaining({ prompt: 'private prompt', lyrics: 'private lyrics' })
     )
   })
-
-  it.each([
-    [
-      'image',
-      () =>
-        generateImageServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.png' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-    [
-      'video',
-      () =>
-        generateVideoServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.png' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-    [
-      'audio',
-      () =>
-        generateAudioServerTool.execute(
-          { prompt: 'safe', inputs: { files: [{ path: 'files/reference.mp3' }] } },
-          contextWithSecrets([])
-        ),
-    ],
-  ])(
-    'rejects unsafe %s references before fetching bytes or calling a model',
-    async (_name, run) => {
-      mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-      await expect(run()).resolves.toEqual(
-        expect.objectContaining({
-          success: false,
-          message: expect.stringContaining('cannot be sent'),
-        })
-      )
-
-      expect(mockReadWorkspaceFileContent).not.toHaveBeenCalled()
-      expect(mockGenerateContent).not.toHaveBeenCalled()
-      expect(mockGenerateFalVideo).not.toHaveBeenCalled()
-      expect(mockGenerateFalAudio).not.toHaveBeenCalled()
-    }
-  )
 })
diff --git a/apps/sim/lib/mothership/tools/server/model-input.test.ts b/apps/sim/lib/mothership/tools/server/model-input.test.ts
deleted file mode 100644
index 731172560c9..00000000000
--- a/apps/sim/lib/mothership/tools/server/model-input.test.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import {
-  workspaceFileSecretProvenanceMock,
-  workspaceFileSecretProvenanceMockFns,
-} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const { mockIsOpaqueWorkspaceFileEgressSafe } = workspaceFileSecretProvenanceMockFns
-
-vi.mock(
-  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
-  () => workspaceFileSecretProvenanceMock
-)
-
-import { assertOpaqueWorkspaceFileModelSafe } from '@/lib/mothership/tools/server/model-input'
-
-const file = {
-  id: 'file-1',
-  workspaceId: 'workspace-1',
-  name: 'reference.png',
-  key: 'workspace/workspace-1/reference.png',
-  path: '/api/files/serve/reference.png',
-  size: 10,
-  type: 'image/png',
-  uploadedBy: 'user-1',
-  uploadedAt: new Date('2026-08-05T00:00:00.000Z'),
-  updatedAt: new Date('2026-08-05T00:00:00.000Z'),
-  storageContext: 'workspace' as const,
-}
-
-describe('server tool model-input boundary', () => {
-  beforeEach(() => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(true)
-  })
-
-  it('binds opaque checks to the exact workspace file before allowing model egress', async () => {
-    await expect(
-      assertOpaqueWorkspaceFileModelSafe({
-        workspaceId: 'workspace-1',
-        file,
-      })
-    ).resolves.toBeUndefined()
-    expect(mockIsOpaqueWorkspaceFileEgressSafe).toHaveBeenCalledWith('workspace-1', {
-      fileId: 'file-1',
-      key: 'workspace/workspace-1/reference.png',
-      context: 'workspace',
-    })
-  })
-
-  it('rejects tainted or unavailable opaque provenance', async () => {
-    mockIsOpaqueWorkspaceFileEgressSafe.mockResolvedValue(false)
-
-    await expect(
-      assertOpaqueWorkspaceFileModelSafe({ workspaceId: 'workspace-1', file })
-    ).rejects.toThrow('File cannot be sent to a model')
-  })
-})
diff --git a/apps/sim/lib/mothership/tools/server/model-input.ts b/apps/sim/lib/mothership/tools/server/model-input.ts
index 6790c53e825..d200573993a 100644
--- a/apps/sim/lib/mothership/tools/server/model-input.ts
+++ b/apps/sim/lib/mothership/tools/server/model-input.ts
@@ -1,30 +1,6 @@
-import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  isOpaqueWorkspaceFileEgressSafe,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-
 export class ServerToolModelInputError extends Error {
   constructor(message: string) {
     super(message)
     this.name = 'ServerToolModelInputError'
   }
 }
-
-/**
- * Verifies the exact persisted provenance bound to an opaque workspace file before its bytes leave
- * Sim. Opaque media cannot be rewritten safely, so tracked or unavailable provenance is rejected.
- */
-export async function assertOpaqueWorkspaceFileModelSafe(args: {
-  workspaceId: string
-  file: WorkspaceFileRecord
-}): Promise<void> {
-  const safe = await isOpaqueWorkspaceFileEgressSafe(args.workspaceId, {
-    fileId: args.file.id,
-    key: args.file.key,
-    context: args.file.storageContext ?? 'workspace',
-  })
-  if (!safe) {
-    throw new ServerToolModelInputError(MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
-  }
-}
diff --git a/apps/sim/lib/organization-secrets/application/operations.ts b/apps/sim/lib/organization-secrets/application/operations.ts
index fed17df32ee..d8066585d43 100644
--- a/apps/sim/lib/organization-secrets/application/operations.ts
+++ b/apps/sim/lib/organization-secrets/application/operations.ts
@@ -37,6 +37,7 @@ export const organizationSecretOperations = {
   /** permission-group-exempt: runtime use is governed by the authorized Build conversation, independently of secret-management UI access. */
   listNames: defineOrganizationOperation({
     id: 'organization_secrets.names',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     delegationAudience: ORGANIZATION_SECRETS_AUDIENCE,
@@ -46,6 +47,7 @@ export const organizationSecretOperations = {
   /** permission-group-exempt: runtime use is governed by the authorized Build conversation, independently of secret-management UI access. */
   mount: defineOrganizationOperation({
     id: 'organization_secrets.mount',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['organization_delegated'],
     delegationAudience: ORGANIZATION_SECRETS_AUDIENCE,
diff --git a/apps/sim/lib/organizations/application/configuration-operations.ts b/apps/sim/lib/organizations/application/configuration-operations.ts
index 03671c19c4f..f3357bfe20b 100644
--- a/apps/sim/lib/organizations/application/configuration-operations.ts
+++ b/apps/sim/lib/organizations/application/configuration-operations.ts
@@ -11,6 +11,7 @@ export const organizationConfigurationOperations = {
   readWhitelabel: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.whitelabel.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -18,6 +19,7 @@ export const organizationConfigurationOperations = {
   updateWhitelabel: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.whitelabel.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
@@ -25,6 +27,7 @@ export const organizationConfigurationOperations = {
   readSessionPolicy: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.session_policy.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -32,6 +35,7 @@ export const organizationConfigurationOperations = {
   updateSessionPolicy: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.session_policy.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
@@ -39,6 +43,7 @@ export const organizationConfigurationOperations = {
   readDataRetention: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.data_retention.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
   }),
@@ -46,6 +51,7 @@ export const organizationConfigurationOperations = {
   updateDataRetention: defineOrganizationOperation({
     ...configurationPolicy,
     id: 'organizations.data_retention.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
   }),
diff --git a/apps/sim/lib/organizations/application/member-roster.ts b/apps/sim/lib/organizations/application/member-roster.ts
index 98b2133ccad..a7b10a005d4 100644
--- a/apps/sim/lib/organizations/application/member-roster.ts
+++ b/apps/sim/lib/organizations/application/member-roster.ts
@@ -27,6 +27,7 @@ import {
 /** permission-group-exempt: members are checked below; admins retain access to manage the directory setting. */
 export const readOrganizationRosterOperation = defineOrganizationOperation({
   id: 'organization.members.roster',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'none',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/organizations/application/operations.ts b/apps/sim/lib/organizations/application/operations.ts
index 5f4fa9511d7..e79a5fc75d3 100644
--- a/apps/sim/lib/organizations/application/operations.ts
+++ b/apps/sim/lib/organizations/application/operations.ts
@@ -46,6 +46,7 @@ export const organizationOperations = {
    */
   updateMember: defineOrganizationOperation({
     id: 'organizations.members.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -58,6 +59,7 @@ export const organizationOperations = {
    */
   removeMember: defineOrganizationOperation({
     id: 'organizations.members.remove',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -97,6 +99,7 @@ export const organizationOperations = {
   }),
   createInvitation: defineOrganizationOperation({
     id: 'organizations.invitations.create',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     capability: 'invitations.send',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
@@ -110,6 +113,7 @@ export const organizationSettingsOperations = {
   /** permission-group-exempt: organization members may read their organization's identity. */
   read: defineOrganizationOperation({
     id: 'organization.settings.read',
+    contentDelivery: 'none',
     minimumRole: 'member',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -119,6 +123,7 @@ export const organizationSettingsOperations = {
   /** permission-group-exempt: organization administrators manage its identity. */
   update: defineOrganizationOperation({
     id: 'organization.settings.update',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -139,6 +144,7 @@ export const organizationSecurityOperations = {
   listDomains: defineOrganizationOperation({
     oauthScope: 'api:read',
     id: 'organizations.domains.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     ...securityPolicy,
     capability: 'none',
@@ -147,6 +153,7 @@ export const organizationSecurityOperations = {
   addDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.add',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
@@ -155,6 +162,7 @@ export const organizationSecurityOperations = {
   verifyDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.verify',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
@@ -163,6 +171,7 @@ export const organizationSecurityOperations = {
   removeDomain: defineOrganizationOperation({
     oauthScope: 'api:write',
     id: 'organizations.domains.remove',
+    contentDelivery: 'none',
     minimumRole: 'admin',
     ...securityPolicy,
     capability: 'none',
diff --git a/apps/sim/lib/permission-groups/application/operations.ts b/apps/sim/lib/permission-groups/application/operations.ts
index 869d8309616..5ec9f95fb55 100644
--- a/apps/sim/lib/permission-groups/application/operations.ts
+++ b/apps/sim/lib/permission-groups/application/operations.ts
@@ -7,6 +7,7 @@ function definePermissionGroupOperation<const Id extends string>(
 ) {
   return defineOrganizationOperation({
     id,
+    contentDelivery: 'none',
     minimumRole: 'admin',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'organization_delegated'],
     delegationAudience: 'sim:settings',
@@ -72,5 +73,6 @@ export const permissionGroupWorkspaceOperations = {
     delegatedServices: ['copilot'],
     oauthScope: 'api:read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
diff --git a/apps/sim/lib/sandboxes/application/operations.ts b/apps/sim/lib/sandboxes/application/operations.ts
index 35384ee8589..f92a4b9f1a3 100644
--- a/apps/sim/lib/sandboxes/application/operations.ts
+++ b/apps/sim/lib/sandboxes/application/operations.ts
@@ -33,6 +33,7 @@ export const sandboxOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -41,6 +42,7 @@ export const sandboxOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -49,6 +51,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -57,6 +60,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -65,6 +69,7 @@ export const sandboxOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'sandboxes.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/secrets/application/operations.ts b/apps/sim/lib/secrets/application/operations.ts
index 080eb2d2993..793558106c5 100644
--- a/apps/sim/lib/secrets/application/operations.ts
+++ b/apps/sim/lib/secrets/application/operations.ts
@@ -14,6 +14,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -23,6 +24,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -32,6 +34,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -45,6 +48,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
@@ -59,6 +63,7 @@ export const secretOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'secrets.manage',
+    contentDelivery: 'none',
     principalKinds: HUMAN_API_PRINCIPAL_KINDS,
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/selectors/application/operations.ts b/apps/sim/lib/selectors/application/operations.ts
index 8594705d022..588e3f31529 100644
--- a/apps/sim/lib/selectors/application/operations.ts
+++ b/apps/sim/lib/selectors/application/operations.ts
@@ -12,5 +12,6 @@ export const selectorOperations = {
     delegatedServices: ['copilot'],
     oauthScope: 'api:read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
diff --git a/apps/sim/lib/settings/application/context.ts b/apps/sim/lib/settings/application/context.ts
index 739dc35ed15..939c34d340c 100644
--- a/apps/sim/lib/settings/application/context.ts
+++ b/apps/sim/lib/settings/application/context.ts
@@ -7,6 +7,7 @@ const settingsContextOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'copilot.use',
+  contentDelivery: 'none',
   principalKinds: ['delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/sim-search/live/application.ts b/apps/sim/lib/sim-search/live/application.ts
index 6c92a86a95c..2a699fea629 100644
--- a/apps/sim/lib/sim-search/live/application.ts
+++ b/apps/sim/lib/sim-search/live/application.ts
@@ -17,6 +17,7 @@ import {
   workspaceSearchFiltersSchema,
 } from '@/lib/api/contracts/mothership-assistant-tools'
 import { canonicalJson, fingerprint, instantScopePart } from '@/lib/api/cursor-binding'
+import { admitContent } from '@/lib/core/application'
 import { env } from '@/lib/core/config/env'
 import { isRetryableNetworkError } from '@/lib/core/errors/retryable-infrastructure'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -391,6 +392,8 @@ export const searchLiveKnowledge = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.search,
   resolveContext: ({ input }: { input: LiveSearchInput }) => resolveKnowledgeOwnerContext(input),
   async execute({ principal, input }): Promise<WorkspaceKnowledgeSearchData> {
+    /** Live provider results carry no stored provenance; they are projected through `safeContent`. */
+    await admitContent(principal, [])
     const userId = requirePrincipalSubjectUserId(principal)
     if (input.organizationId) await requireOrganizationSearchAvailable(input.organizationId)
     input.signal?.throwIfAborted()
@@ -851,6 +854,8 @@ export const readLiveDocument = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.readDocument,
   resolveContext: ({ input }: { input: LiveReadInput }) => resolveKnowledgeOwnerContext(input),
   async execute({ principal, input }) {
+    /** Live provider documents carry no stored provenance; they are projected through `safeContent`. */
+    await admitContent(principal, [])
     const userId = requirePrincipalSubjectUserId(principal)
     if (input.organizationId) await requireOrganizationSearchAvailable(input.organizationId)
     if (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 8)
diff --git a/apps/sim/lib/skills/application/operations.ts b/apps/sim/lib/skills/application/operations.ts
index 766fe6f1fb9..c348a280a40 100644
--- a/apps/sim/lib/skills/application/operations.ts
+++ b/apps/sim/lib/skills/application/operations.ts
@@ -52,6 +52,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   listAvailable: defineWorkspaceOperation({
@@ -60,6 +61,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   read: defineWorkspaceOperation({
@@ -68,6 +70,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...ALL_PRINCIPAL_POLICY,
   }),
   create: defineWorkspaceOperation({
@@ -76,6 +79,7 @@ export const skillOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   update: defineWorkspaceOperation({
@@ -84,6 +88,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   /**
@@ -102,6 +107,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -110,6 +116,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_PRINCIPAL_POLICY,
   }),
   listEditors: defineWorkspaceOperation({
@@ -118,6 +125,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HTTP_SKILL_EDITOR_READ_POLICY,
   }),
   grantEditor: defineWorkspaceOperation({
@@ -126,6 +134,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_HTTP_SKILL_EDITOR_POLICY,
   }),
   revokeEditor: defineWorkspaceOperation({
@@ -134,6 +143,7 @@ export const skillOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'skills.use',
+    contentDelivery: 'none',
     ...HUMAN_HTTP_SKILL_EDITOR_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/table/application/operations.ts b/apps/sim/lib/table/application/operations.ts
index 103f0e4f31b..6d7531d8c99 100644
--- a/apps/sim/lib/table/application/operations.ts
+++ b/apps/sim/lib/table/application/operations.ts
@@ -1,3 +1,4 @@
+import type { ContentDeliveryDeclaration } from '@/lib/core/application'
 import type { OperationDeclarableCapability } from '@/lib/core/application/operation'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
 
@@ -27,9 +28,13 @@ const ALL_TABLE_TOOL_PRINCIPAL_POLICY = {
   delegatedServices: ['copilot', 'executor'],
 } as const
 
-function readOperation<const Id extends string>(id: Id) {
+function readOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:read',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -38,9 +43,13 @@ function readOperation<const Id extends string>(id: Id) {
   })
 }
 
-function writeOperation<const Id extends string>(id: Id) {
+function writeOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -60,10 +69,12 @@ function writeOperation<const Id extends string>(id: Id) {
  */
 function toolWriteOperation<const Id extends string>(
   id: Id,
-  capability: OperationDeclarableCapability
+  capability: OperationDeclarableCapability,
+  contentDelivery: ContentDeliveryDeclaration
 ) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -72,9 +83,13 @@ function toolWriteOperation<const Id extends string>(
   })
 }
 
-function toolReadOperation<const Id extends string>(id: Id) {
+function toolReadOperation<const Id extends string>(
+  id: Id,
+  contentDelivery: ContentDeliveryDeclaration
+) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery,
     oauthScope: 'api:read',
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -90,6 +105,7 @@ function stagedReadOperation<const Id extends string>(
 ) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery: 'none',
     oauthScope,
     minimumRole: 'read',
     workspaceApiKey: 'allow',
@@ -101,6 +117,7 @@ function stagedReadOperation<const Id extends string>(
 function stagedWriteOperation<const Id extends string>(id: Id) {
   return defineWorkspaceOperation({
     id,
+    contentDelivery: 'none',
     oauthScope: 'api:write',
     minimumRole: 'write',
     workspaceApiKey: 'allow',
@@ -110,30 +127,31 @@ function stagedWriteOperation<const Id extends string>(id: Id) {
 }
 
 export const tableOperations = {
-  list: toolReadOperation('tables.list'),
-  read: toolReadOperation('tables.read'),
+  list: toolReadOperation('tables.list', 'none'),
+  read: toolReadOperation('tables.read', 'none'),
   readSnapshot: defineWorkspaceOperation({
     id: 'tables.snapshot.read',
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'tables.use',
+    contentDelivery: 'sourced',
     ...COPILOT_PRINCIPAL_POLICY,
   }),
-  create: toolWriteOperation('tables.create', 'tables.create'),
-  update: writeOperation('tables.update'),
-  delete: writeOperation('tables.delete'),
-  restore: writeOperation('tables.restore'),
-  bulkMove: writeOperation('tables.bulk_move'),
-  bulkDelete: writeOperation('tables.bulk_delete'),
-  listFolders: readOperation('tables.folders.list'),
-  createFolder: writeOperation('tables.folders.create'),
-  updateFolder: writeOperation('tables.folders.update'),
-  deleteFolder: writeOperation('tables.folders.delete'),
-  restoreFolder: writeOperation('tables.folders.restore'),
-  addColumn: writeOperation('tables.columns.add'),
-  updateColumn: writeOperation('tables.columns.update'),
-  deleteColumn: writeOperation('tables.columns.delete'),
-  listRows: readOperation('tables.rows.list'),
+  create: toolWriteOperation('tables.create', 'tables.create', 'none'),
+  update: writeOperation('tables.update', 'none'),
+  delete: writeOperation('tables.delete', 'none'),
+  restore: writeOperation('tables.restore', 'none'),
+  bulkMove: writeOperation('tables.bulk_move', 'none'),
+  bulkDelete: writeOperation('tables.bulk_delete', 'none'),
+  listFolders: readOperation('tables.folders.list', 'none'),
+  createFolder: writeOperation('tables.folders.create', 'none'),
+  updateFolder: writeOperation('tables.folders.update', 'none'),
+  deleteFolder: writeOperation('tables.folders.delete', 'none'),
+  restoreFolder: writeOperation('tables.folders.restore', 'none'),
+  addColumn: writeOperation('tables.columns.add', 'none'),
+  updateColumn: writeOperation('tables.columns.update', 'none'),
+  deleteColumn: writeOperation('tables.columns.delete', 'none'),
+  listRows: readOperation('tables.rows.list', 'sourced'),
   analytics: defineWorkspaceOperation({
     id: 'tables.rows.analytics',
     minimumRole: 'read',
@@ -141,29 +159,29 @@ export const tableOperations = {
     capability: 'tables.use',
     principalKinds: ['session'],
   }),
-  queryRows: toolReadOperation('tables.rows.query'),
-  searchRows: readOperation('tables.rows.search'),
-  readRow: toolReadOperation('tables.rows.read'),
-  createRows: toolWriteOperation('tables.rows.create', 'tables.use'),
-  replaceRows: writeOperation('tables.rows.replace'),
-  updateRow: toolWriteOperation('tables.rows.update', 'tables.use'),
-  updateRows: toolWriteOperation('tables.rows.update_many', 'tables.use'),
-  deleteRow: toolWriteOperation('tables.rows.delete', 'tables.use'),
-  deleteRows: toolWriteOperation('tables.rows.delete_many', 'tables.use'),
-  upsertRow: toolWriteOperation('tables.rows.upsert', 'tables.use'),
-  listViews: readOperation('tables.views.list'),
-  readView: readOperation('tables.views.read'),
-  createView: writeOperation('tables.views.create'),
-  updateView: writeOperation('tables.views.update'),
-  deleteView: writeOperation('tables.views.delete'),
-  listGroups: readOperation('tables.groups.list'),
-  createGroup: toolWriteOperation('tables.groups.create', 'tables.use'),
-  updateGroup: toolWriteOperation('tables.groups.update', 'tables.use'),
-  deleteGroup: toolWriteOperation('tables.groups.delete', 'tables.use'),
-  startRun: writeOperation('tables.runs.start'),
+  queryRows: toolReadOperation('tables.rows.query', 'sourced'),
+  searchRows: readOperation('tables.rows.search', 'none'),
+  readRow: toolReadOperation('tables.rows.read', 'sourced'),
+  createRows: toolWriteOperation('tables.rows.create', 'tables.use', 'sourced'),
+  replaceRows: writeOperation('tables.rows.replace', 'none'),
+  updateRow: toolWriteOperation('tables.rows.update', 'tables.use', 'sourced'),
+  updateRows: toolWriteOperation('tables.rows.update_many', 'tables.use', 'none'),
+  deleteRow: toolWriteOperation('tables.rows.delete', 'tables.use', 'none'),
+  deleteRows: toolWriteOperation('tables.rows.delete_many', 'tables.use', 'none'),
+  upsertRow: toolWriteOperation('tables.rows.upsert', 'tables.use', 'sourced'),
+  listViews: readOperation('tables.views.list', 'none'),
+  readView: readOperation('tables.views.read', 'none'),
+  createView: writeOperation('tables.views.create', 'none'),
+  updateView: writeOperation('tables.views.update', 'none'),
+  deleteView: writeOperation('tables.views.delete', 'none'),
+  listGroups: readOperation('tables.groups.list', 'none'),
+  createGroup: toolWriteOperation('tables.groups.create', 'tables.use', 'none'),
+  updateGroup: toolWriteOperation('tables.groups.update', 'tables.use', 'none'),
+  deleteGroup: toolWriteOperation('tables.groups.delete', 'tables.use', 'none'),
+  startRun: writeOperation('tables.runs.start', 'none'),
   /** Reading the state of a run — including one you started — is a read. */
-  readRun: readOperation('tables.runs.read'),
-  cancelRuns: writeOperation('tables.runs.cancel'),
+  readRun: readOperation('tables.runs.read', 'none'),
+  cancelRuns: writeOperation('tables.runs.cancel', 'none'),
   createImport: stagedWriteOperation('tables.imports.create'),
   readImport: stagedReadOperation('tables.imports.read', 'tables.use', 'api:read'),
   createImportParts: stagedWriteOperation('tables.imports.create_parts'),
@@ -178,7 +196,18 @@ export const tableOperations = {
   createExport: stagedReadOperation('tables.exports.create', 'tables.export', 'api:write'),
   readExport: stagedReadOperation('tables.exports.read', 'tables.use', 'api:read'),
   cancelExport: stagedReadOperation('tables.exports.cancel', 'tables.use', 'api:write'),
-  downloadExport: stagedReadOperation('tables.exports.download', 'tables.export', 'api:read'),
+  /**
+   * A signed link to the whole table as plaintext, which no row provenance follows once fetched,
+   * so Chat is not delegated to it; it reads rows, each under its own provenance, instead.
+   */
+  downloadExport: defineWorkspaceOperation({
+    id: 'tables.exports.download',
+    oauthScope: 'api:read',
+    minimumRole: 'read',
+    workspaceApiKey: 'allow',
+    capability: 'tables.export',
+    principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'workspace_api_key'],
+  }),
 } as const
 
 export type TableOperation = (typeof tableOperations)[keyof typeof tableOperations]
diff --git a/apps/sim/lib/table/application/read-table-snapshot.ts b/apps/sim/lib/table/application/read-table-snapshot.ts
index f42d3e1442c..334466daee5 100644
--- a/apps/sim/lib/table/application/read-table-snapshot.ts
+++ b/apps/sim/lib/table/application/read-table-snapshot.ts
@@ -1,4 +1,6 @@
+import { requireAdmittedContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { EXACT_EMPTY_DURABLE_SECRET_PROVENANCE } from '@/lib/execution/durable-secret-provenance'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
 import {
   MAX_INLINE_MOUNT_FILE_BYTES,
@@ -38,7 +40,6 @@ export interface ReadTableSnapshotInput {
 export interface ReadTableSnapshotResult {
   mount: SandboxFile
   budget: SandboxMountBudget
-  unsafeProvenance: boolean
 }
 
 /** Resolves and reads one CSV snapshot under the caller's current workspace authority. */
@@ -48,7 +49,7 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
     input.signal?.throwIfAborted()
     return resolveTableWorkspaceContext(input.workspaceId)
   },
-  async execute({ input, context }): Promise<ReadTableSnapshotResult> {
+  async execute({ input, context, principal }): Promise<ReadTableSnapshotResult> {
     input.signal?.throwIfAborted()
     const reference = input.reference.replace(/^\/+/, '')
     const segments = reference.startsWith('tables/')
@@ -77,6 +78,16 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
         `Input table "${input.reference}" changed while preparing its snapshot. Retry.`
       )
     }
+    /**
+     * The snapshot is one cached CSV of every row, so the table enters the workbench whole or not
+     * at all: a row holding a recorded secret, or one without vouched provenance, keeps it out.
+     */
+    await requireAdmittedContent(principal, {
+      kind: 'table-row',
+      id: table.id,
+      provenance: safety === 'safe' ? EXACT_EMPTY_DURABLE_SECRET_PROVENANCE : { status: 'unknown' },
+      view: 'complete',
+    })
     const budget = { ...input.budget }
     const path = input.sandboxPath ?? `/home/user/tables/${table.id}.csv`
     let mount: SandboxFile
@@ -110,6 +121,6 @@ export const readTableSnapshot = defineAuthorizedTableUseCase({
       budget.buffered += buffer.length
     }
     input.signal?.throwIfAborted()
-    return { mount, budget, unsafeProvenance: safety === 'unsafe-provenance' }
+    return { mount, budget }
   },
 })
diff --git a/apps/sim/lib/table/application/row-delivery-observer.ts b/apps/sim/lib/table/application/row-delivery-observer.ts
deleted file mode 100644
index 37168b52b70..00000000000
--- a/apps/sim/lib/table/application/row-delivery-observer.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-import type { RowData } from '@/lib/table/types'
-import type { ResolvedSecretTraceProvenanceV1 } from '@/executor/utils/resolved-secret-trace-registry'
-
-/** What a use case returns beside its rows that the rows' provenance does not cover. */
-export interface TableRowDeliveryExtras {
-  /**
-   * The result carries run-state or enrichment error text (`error`, `blockErrors`,
-   * cascade provider errors). That text is captured from executor output, which can
-   * contain resolved secret plaintext, and no provenance is persisted with it.
-   */
-  unprovenancedErrorText: boolean
-}
-
-type TableRowDeliveryObserver = (
-  provenance: ResolvedSecretTraceProvenanceV1,
-  values: RowData[],
-  extras: TableRowDeliveryExtras
-) => Promise<void>
-
-const observer = new AsyncLocalStorage<TableRowDeliveryObserver>()
-
-/** Internal transport evidence observes the persisted provenance of returned rows without changing public API admission or output. */
-export function observeTableRowDelivery<T>(observe: TableRowDeliveryObserver, execute: () => T): T {
-  return observer.run(observe, execute)
-}
-
-/** Whether the current call has a transport observing returned rows, so use cases read provenance for it. */
-export function hasTableRowDeliveryObserver(): boolean {
-  return observer.getStore() !== undefined
-}
-
-/** Runs before the canonical use case returns row data to its transport. */
-export async function reportTableRowDelivery(
-  provenance: ResolvedSecretTraceProvenanceV1,
-  values: RowData[],
-  extras: TableRowDeliveryExtras = { unprovenancedErrorText: false }
-): Promise<void> {
-  await observer.getStore()?.(provenance, values, extras)
-}
diff --git a/apps/sim/lib/table/application/rows.test.ts b/apps/sim/lib/table/application/rows.test.ts
index c79d6171a44..ba6f8635345 100644
--- a/apps/sim/lib/table/application/rows.test.ts
+++ b/apps/sim/lib/table/application/rows.test.ts
@@ -22,11 +22,11 @@ import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/wo
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { TableDefinition } from '@/lib/table/types'
 
-const { mockIsScopeCompatible, mockLoadExecutionsForRow, mockLoadEnrichmentDetail } = vi.hoisted(
+const { mockLoadExecutionsForRow, mockLoadEnrichmentDetail, mockRowProvenance } = vi.hoisted(
   () => ({
-    mockIsScopeCompatible: vi.fn(),
     mockLoadExecutionsForRow: vi.fn(),
     mockLoadEnrichmentDetail: vi.fn(),
+    mockRowProvenance: vi.fn(),
   })
 )
 
@@ -45,16 +45,20 @@ vi.mock('@/lib/table/column-types', () => ({
   columnTypeOf: (column: { type: string }) => ({ id: column.type }),
 }))
 
-vi.mock('@/lib/table/rows/secret-provenance', () => tableRowsSecretProvenanceMock)
+/** The reader classifies each row on its own; `mockRowProvenance` answers per row id. */
+vi.mock('@/lib/table/rows/secret-provenance', () => ({
+  ...tableRowsSecretProvenanceMock,
+  TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
+    rowProvenance(rowId: string) {
+      return mockRowProvenance(rowId)
+    }
+  },
+}))
 
 vi.mock('@/lib/table/validation', () => ({
   coerceRowValues: vi.fn(),
 }))
 
-vi.mock('@/lib/execution/durable-secret-provenance', () => ({
-  isPrivateSecretProvenanceScopeCompatible: mockIsScopeCompatible,
-}))
-
 vi.mock('@/lib/table/rows/service', () => tableRowsServiceMock)
 
 vi.mock('@/lib/table/application/context', () => tableApplicationContextMock)
@@ -70,8 +74,13 @@ vi.mock('@/lib/table/rows/executions', () => ({
 
 vi.mock('@/lib/table/events', () => tableEventsMock)
 
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { TABLE_LIMITS } from '@/lib/table'
-import { observeTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
 import {
   batchUpdateTableRows,
   createTableRows,
@@ -203,7 +212,6 @@ describe('replaceProjectedWireRows application command', () => {
     )
     mockReplaceRowsWithTx.mockResolvedValue({ deletedCount: 2, insertedCount: 1 })
     mockCreateSecretProvenance.mockReturnValue({ complete: true, columns: {} })
-    mockIsScopeCompatible.mockReturnValue(true)
   })
 
   it('validates and replaces against the fresh schema held under the table lock', async () => {
@@ -305,10 +313,6 @@ describe('replaceProjectedWireRows application command', () => {
       { 'column-fresh': 'secret-value' },
       registry
     )
-    expect(mockIsScopeCompatible).toHaveBeenCalledWith(
-      { userId: 'user-1', workspaceId: TABLE.workspaceId },
-      { workspaceId: TABLE.workspaceId }
-    )
     expect(mockReplaceRowsWithTx).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({ secretProvenance: [provenance] }),
@@ -328,7 +332,6 @@ describe('replaceProjectedWireRows application command', () => {
         },
       },
     })
-    mockIsScopeCompatible.mockReturnValue(false)
 
     await replaceProjectedWireRows.execute({
       principal: delegatedPrincipal,
@@ -343,10 +346,6 @@ describe('replaceProjectedWireRows application command', () => {
       },
     })
 
-    expect(mockIsScopeCompatible).toHaveBeenCalledWith(
-      { userId: 'user-1', workspaceId: 'workspace-other' },
-      { workspaceId: TABLE.workspaceId }
-    )
     expect(mockReplaceRowsWithTx).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({ secretProvenance: [{ complete: false, columns: {} }] }),
@@ -652,7 +651,6 @@ describe('row data keying', () => {
     mockResolveContext.mockResolvedValue(contextFor())
     mockAssertRowCapacity.mockResolvedValue(10_000)
     mockCreateSecretProvenance.mockReturnValue({ complete: true, columns: {} })
-    mockIsScopeCompatible.mockReturnValue(true)
   })
 
   it('does not silently drop an id-keyed write, which the name path would', async () => {
@@ -833,11 +831,11 @@ describe('enrichment detail id validation', () => {
 })
 
 /**
- * An internal transport that observes delivery (the Copilot CLI) must see the
- * persisted provenance of every row a row-returning use case hands back, even
- * though the public surface it dispatched never asks for it on the wire.
+ * Chat's gate decides every row a row-returning use case hands back, each by its own persisted
+ * provenance, even though the public surface it dispatched never asks for it on the wire. Every
+ * other caller is served as before, without a provenance read.
  */
-describe('row delivery to an observing transport', () => {
+describe('row delivery to Chat', () => {
   const ENRICHED_TABLE: TableDefinition = {
     ...TABLE,
     schema: {
@@ -868,21 +866,29 @@ describe('row delivery to an observing transport', () => {
     mockUpsertRow.mockResolvedValue({ operation: 'update', row: ROW })
   })
 
+  const CHAT = createDelegatedPrincipal({
+    workspaceId: TABLE.workspaceId,
+    delegationId: 'copilot-tool:tool-1',
+    audience: 'sim:tables',
+    resourceScope: { tableId: TABLE.id },
+  })
+  type Caller = typeof PRINCIPAL | typeof CHAT
+
   const reads = {
-    list: () =>
-      listTableRows.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, limit: 25 } }),
-    query: () =>
-      queryTableRows.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, limit: 25 } }),
-    read: () =>
-      readTableRow.execute({ principal: PRINCIPAL, input: { tableId: TABLE.id, rowId: ROW.id } }),
-    enrichment: () =>
+    list: (principal: Caller) =>
+      listTableRows.execute({ principal, input: { tableId: TABLE.id, limit: 25 } }),
+    query: (principal: Caller) =>
+      queryTableRows.execute({ principal, input: { tableId: TABLE.id, limit: 25 } }),
+    read: (principal: Caller) =>
+      readTableRow.execute({ principal, input: { tableId: TABLE.id, rowId: ROW.id } }),
+    enrichment: (principal: Caller) =>
       readTableRowEnrichmentDetail.execute({
-        principal: PRINCIPAL,
+        principal,
         input: { tableId: TABLE.id, rowId: ROW.id, groupId: 'group-1' },
       }),
-    create: () =>
+    create: (principal: Caller) =>
       createTableRows.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           kind: 'single',
           tableId: TABLE.id,
@@ -891,9 +897,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    createBatch: () =>
+    createBatch: (principal: Caller) =>
       createTableRows.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           kind: 'batch',
           tableId: TABLE.id,
@@ -902,9 +908,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    update: () =>
+    update: (principal: Caller) =>
       updateTableRow.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           tableId: TABLE.id,
           rowId: ROW.id,
@@ -913,9 +919,9 @@ describe('row delivery to an observing transport', () => {
           dataKeying: 'names',
         },
       }),
-    upsert: () =>
+    upsert: (principal: Caller) =>
       upsertTableRow.execute({
-        principal: PRINCIPAL,
+        principal,
         input: {
           tableId: TABLE.id,
           data: { name: 'secret-cell' },
@@ -924,31 +930,76 @@ describe('row delivery to an observing transport', () => {
         },
       }),
   }
+  const names = Object.keys(reads) as Array<keyof typeof reads>
+  const writes = new Set<keyof typeof reads>(['create', 'createBatch', 'update', 'upsert'])
+
+  function gate(verdict: boolean) {
+    return vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => verdict))
+  }
 
-  it.each(Object.keys(reads) as Array<keyof typeof reads>)(
-    '%s reports the returned rows and their provenance',
+  it.each(names)('%s admits each returned row for Chat by its own provenance', async (name) => {
+    const provenance = { status: 'exact', entries: [] }
+    mockRowProvenance.mockReturnValue(provenance)
+    const admit = gate(true)
+    await observeContentDelivery({ admit }, () => reads[name](CHAT))
+
+    expect(mockLoadSecretProvenance).toHaveBeenCalledWith(
+      { userId: CHAT.subjectUserId, workspaceId: TABLE.workspaceId },
+      undefined
+    )
+    expect(mockRowProvenance).toHaveBeenCalledWith(ROW.id)
+    expect(admit).toHaveBeenCalledTimes(1)
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'table-row', id: ROW.id, provenance, view: { derived: ROW.data } },
+    ])
+  })
+
+  it.each(names)('%s refuses Chat when no gate observes it', async (name) => {
+    await expect(reads[name](CHAT)).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+  })
+
+  it.each(['list', 'query'] as const)(
+    '%s leaves a refused row out of the page rather than withholding it',
     async (name) => {
-      const observe = vi.fn(async () => {})
-      const result = await observeTableRowDelivery(observe, reads[name])
+      mockRowProvenance.mockReturnValue({ status: 'unknown' })
+      const result = await observeContentDelivery({ admit: gate(false) }, () => reads[name](CHAT))
+      expect(result.rows).toEqual([])
+    }
+  )
 
-      expect(mockLoadSecretProvenance).toHaveBeenCalledWith(
-        {
-          userId: PRINCIPAL.userId,
-          workspaceId: TABLE.workspaceId,
-        },
-        undefined
-      )
-      expect(observe).toHaveBeenCalledTimes(1)
-      expect(observe).toHaveBeenCalledWith(
-        { version: 1, complete: true, entries: [] },
-        [ROW.data],
-        {
-          unprovenancedErrorText: false,
-        }
+  it.each(['read', 'enrichment'] as const)('%s refuses a refused row with a 403', async (name) => {
+    mockRowProvenance.mockReturnValue({ status: 'unknown' })
+    await expect(
+      observeContentDelivery({ admit: gate(false) }, () => reads[name](CHAT))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it.each([...writes])(
+    '%s commits and audits the write, then refuses its refused returned row',
+    async (name) => {
+      mockRowProvenance.mockReturnValue({ status: 'unknown' })
+      const refusal = await observeContentDelivery({ admit: gate(false) }, () =>
+        reads[name](CHAT)
+      ).then(
+        () => undefined,
+        (error: unknown) => error
       )
-      expect((result as { secretProvenance?: unknown }).secretProvenance).toBeUndefined()
+      expect(refusal).toBeInstanceOf(ContentRefusedError)
+      expect(refusal).toMatchObject({ message: expect.stringContaining('The change was saved') })
+      expect(mockRecordAudit).toHaveBeenCalled()
+    }
+  )
+
+  it.each(names.filter((name) => !writes.has(name)))(
+    '%s reads no provenance for a session caller, which no gate classifies',
+    async (name) => {
+      const admit = gate(false)
+      await observeContentDelivery({ admit }, () => reads[name](PRINCIPAL))
+      expect(mockLoadSecretProvenance).not.toHaveBeenCalled()
+      expect(admit).not.toHaveBeenCalled()
     }
   )
+
   describe('run-state and enrichment error text', () => {
     const CLEAN_RUN = {
       status: 'completed',
@@ -964,57 +1015,51 @@ describe('row delivery to an observing transport', () => {
       blockErrors: { 'block-1': 'Authorization: Bearer sk-live-secret' },
     }
 
-    async function reportedErrorText(read: () => Promise<unknown>): Promise<boolean> {
-      const observe = vi.fn(async () => {})
-      await observeTableRowDelivery(observe, read)
-      expect(observe).toHaveBeenCalledTimes(1)
-      const extras = observe.mock.calls[0]?.[2] as { unprovenancedErrorText: boolean }
-      return extras.unprovenancedErrorText
-    }
-
     const withRunState = {
-      list: () =>
+      list: (principal: Caller) =>
         listTableRows.execute({
-          principal: PRINCIPAL,
+          principal,
           input: { tableId: TABLE.id, limit: 25, includeRunState: true },
         }),
-      query: () =>
+      query: (principal: Caller) =>
         queryTableRows.execute({
-          principal: PRINCIPAL,
+          principal,
           input: { tableId: TABLE.id, limit: 25, includeRunState: true },
         }),
     }
 
+    beforeEach(() => {
+      mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
+    })
+
     it.each(Object.keys(withRunState) as Array<keyof typeof withRunState>)(
-      '%s signals returned run-state error text',
+      '%s withholds run-state error text from Chat and keeps it for other callers',
       async (name) => {
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [
-            { ...ROW, executions: { 'group-1': CLEAN_RUN } },
-            { ...ROW, id: 'row-2', executions: { 'group-1': RUN_WITH_ERROR } },
-          ],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(true)
-
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [{ ...ROW, executions: { 'group-1': RUN_WITH_BLOCK_ERROR } }],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(true)
+        for (const executions of [
+          { 'group-1': RUN_WITH_ERROR },
+          { 'group-1': RUN_WITH_BLOCK_ERROR },
+        ]) {
+          mockQueryRows.mockResolvedValue({ ...PAGE, rows: [{ ...ROW, executions }] })
+          const chat = await observeContentDelivery({ admit: gate(true) }, () =>
+            withRunState[name](CHAT)
+          )
+          expect(JSON.stringify(chat.rows)).not.toContain('sk-live-secret')
+          expect(chat.rows[0]?.executions?.['group-1']?.status).toBe('error')
+          const session = await withRunState[name](PRINCIPAL)
+          expect(JSON.stringify(session.rows)).toContain('sk-live-secret')
+        }
       }
     )
 
     it.each(Object.keys(withRunState) as Array<keyof typeof withRunState>)(
-      '%s does not signal run state without error text',
+      '%s leaves run state without error text unchanged for Chat',
       async (name) => {
-        mockQueryRows.mockResolvedValue({
-          ...PAGE,
-          rows: [
-            { ...ROW, executions: { 'group-1': { ...CLEAN_RUN, error: '', blockErrors: {} } } },
-          ],
-        })
-        expect(await reportedErrorText(withRunState[name])).toBe(false)
+        const executions = { 'group-1': { ...CLEAN_RUN, error: '', blockErrors: {} } }
+        mockQueryRows.mockResolvedValue({ ...PAGE, rows: [{ ...ROW, executions }] })
+        const chat = await observeContentDelivery({ admit: gate(true) }, () =>
+          withRunState[name](CHAT)
+        )
+        expect(chat.rows[0]?.executions).toEqual(executions)
       }
     )
   })
diff --git a/apps/sim/lib/table/application/rows.ts b/apps/sim/lib/table/application/rows.ts
index 9f65e75baf4..b10607ebbbc 100644
--- a/apps/sim/lib/table/application/rows.ts
+++ b/apps/sim/lib/table/application/rows.ts
@@ -5,7 +5,14 @@ import { db } from '@sim/db'
 import { getRequestContext } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { isPlainRecord, toRecord } from '@sim/utils/object'
-import { capabilityGovernedPrincipalUserId } from '@/lib/core/application'
+import {
+  admitContent,
+  admitWrittenContent,
+  ContentRefusedError,
+  capabilityGovernedPrincipalUserId,
+  isCopilotPrincipal,
+  mustClassifyContent,
+} from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPrivateSecretProvenanceScopeCompatible } from '@/lib/execution/durable-secret-provenance'
 import type {
@@ -51,10 +58,6 @@ import {
 import { defineAuthorizedTableUseCase } from '@/lib/table/application/authorized-table-use-case'
 import { resolveActiveTableContext } from '@/lib/table/application/context'
 import { tableOperations } from '@/lib/table/application/operations'
-import {
-  hasTableRowDeliveryObserver,
-  reportTableRowDelivery,
-} from '@/lib/table/application/row-delivery-observer'
 import {
   resolveRowWriteProvenance,
   type TableRowProvenanceEnvelope,
@@ -147,66 +150,94 @@ interface TableResult {
 
 type TableRowsProvenance = ReturnType<TableRowProvenanceReader['exportProvenance']>
 
-/** Provenance is read when the caller asked for it or an internal transport observes delivery. */
+/** Provenance is read when the caller asked for it back or Chat must classify the rows. */
 function createAuthorizedRowsProvenanceReader(
+  principal: Principal,
   workspaceId: string,
   attributedUserId: string,
   include?: boolean
 ): TableRowProvenanceReader | undefined {
-  return include || hasTableRowDeliveryObserver()
+  return include || mustClassifyContent(principal)
     ? new TableRowProvenanceReader({ userId: attributedUserId, workspaceId })
     : undefined
 }
 
 /**
- * Reports the provenance of the rows a use case is about to return to an observing
- * transport, and hands it back only when the caller itself asked for it.
+ * Admits each returned row on its own, against the classification its reader captured, and returns
+ * the rows admitted. A row whose provenance is unknown is left out rather than withholding the
+ * page. `written` marks the rows a committed write returns (see `admitWrittenContent`).
  */
-async function deliverRowsProvenance(
+async function deliverRows<R extends { id: string; data: RowData }>(
+  principal: Principal,
   reader: TableRowProvenanceReader | undefined,
-  rows: readonly { data: RowData }[],
-  options: {
-    /** The caller itself asked for the provenance back. */
-    include?: boolean
-    /** The result also carries run-state or enrichment error text, which has no provenance. */
-    unprovenancedErrorText?: boolean
-  } = {}
-): Promise<TableRowsProvenance | undefined> {
-  if (!reader) return undefined
-  const provenance = reader.exportProvenance()
-  await reportTableRowDelivery(
-    provenance,
-    rows.map((row) => row.data),
-    { unprovenancedErrorText: options.unprovenancedErrorText ?? false }
-  )
-  return options.include ? provenance : undefined
+  rows: readonly R[],
+  options: { written?: boolean } = {}
+): Promise<R[]> {
+  if (!reader || !mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return [...rows]
+  }
+  const sources = rows.map((row) => ({
+    kind: 'table-row' as const,
+    id: row.id,
+    provenance: reader.rowProvenance(row.id),
+    view: { derived: row.data },
+  }))
+  const admission = await (options.written ? admitWrittenContent : admitContent)(principal, sources)
+  return rows.filter((_, index) => admission.admits(sources[index]))
 }
 
-function isNonEmptyText(value: unknown): boolean {
-  return typeof value === 'string' && value.length > 0
+/**
+ * Run-state and enrichment error text is captured from executor output, which can hold resolved
+ * secret plaintext, and nothing records its provenance, so Chat sees that an error occurred but
+ * not its text. Every other caller sees the text unchanged.
+ */
+const WITHHELD_ERROR_TEXT =
+  'Error details are not shown to Chat: they were captured from run output, which can hold secret values.'
+
+function withoutErrorText(execution: RowExecutionMetadata): RowExecutionMetadata {
+  return {
+    ...execution,
+    ...(execution.error ? { error: WITHHELD_ERROR_TEXT } : {}),
+    ...(execution.blockErrors
+      ? {
+          blockErrors: Object.fromEntries(
+            Object.keys(execution.blockErrors).map((blockId) => [blockId, WITHHELD_ERROR_TEXT])
+          ),
+        }
+      : {}),
+  }
 }
 
-/** Whether one group's run state carries error text: its run `error` or any `blockErrors` entry. */
-function executionHasErrorText(execution: RowExecutionMetadata): boolean {
-  return (
-    isNonEmptyText(execution.error) ||
-    Object.values(execution.blockErrors ?? {}).some(isNonEmptyText)
+function runStateForReader(principal: Principal, executions: RowExecutions): RowExecutions {
+  if (!mustClassifyContent(principal)) return executions
+  return Object.fromEntries(
+    Object.entries(executions).map(([groupId, execution]) => [groupId, withoutErrorText(execution)])
   )
 }
 
-/** Whether any group in a row's run state carries error text. */
-function runStateHasErrorText(executions: RowExecutions): boolean {
-  return Object.values(executions).some(executionHasErrorText)
+function rowsForReader(principal: Principal, rows: TableRow[]): TableRow[] {
+  if (!mustClassifyContent(principal)) return rows
+  return rows.map((row) =>
+    row.executions ? { ...row, executions: runStateForReader(principal, row.executions) } : row
+  )
 }
 
-/**
- * Whether an enrichment cascade carries provider error text. The blob is schemaless JSONB,
- * so it is read as defensively as the v2 presenter projects it.
- */
-function enrichmentDetailHasErrorText(detail: EnrichmentRunDetail | null): boolean {
+/** The enrichment blob is schemaless JSONB, so it is read as defensively as the v2 presenter does. */
+function enrichmentDetailForReader(
+  principal: Principal,
+  detail: EnrichmentRunDetail | null
+): EnrichmentRunDetail | null {
   const providers: unknown = detail?.providers
-  if (!Array.isArray(providers)) return false
-  return providers.some((provider) => isNonEmptyText(toRecord(provider).error))
+  if (!detail || !Array.isArray(providers) || !mustClassifyContent(principal)) return detail
+  return {
+    ...detail,
+    providers: providers.map((provider) =>
+      typeof toRecord(provider).error === 'string'
+        ? { ...toRecord(provider), error: WITHHELD_ERROR_TEXT }
+        : provider
+    ),
+  }
 }
 
 function requestId(input: TableScopedInput): string {
@@ -471,6 +502,7 @@ export const listTableRows = defineAuthorizedTableUseCase({
   async execute({ principal, input, context }): Promise<ListTableRowsResult> {
     requireIntegerInRange(input.limit, 1, TABLE_LIMITS.MAX_QUERY_LIMIT, 'Limit')
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId)
     )
@@ -490,14 +522,10 @@ export const listTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         readProvenance
       )
-      await deliverRowsProvenance(readProvenance, result.rows, {
-        unprovenancedErrorText:
-          input.includeRunState === true &&
-          result.rows.some((row) => runStateHasErrorText(row.executions)),
-      })
+      const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
-        rows: result.rows,
+        rows: rowsForReader(principal, rows),
         nextCursor: result.nextCursor,
       }
     } catch (error) {
@@ -537,6 +565,7 @@ export const queryTableRows = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: QueryTableRowsInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<QueryTableRowsResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -618,15 +647,15 @@ export const queryTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         readProvenance
       )
+      const rows = await deliverRows(principal, readProvenance, result.rows)
       return {
         table: context.table,
         ...result,
-        secretProvenance: await deliverRowsProvenance(readProvenance, result.rows, {
-          include: input.includePersistedSecretProvenance,
-          unprovenancedErrorText:
-            input.includeRunState === true &&
-            result.rows.some((row) => runStateHasErrorText(row.executions)),
-        }),
+        rowCount: isCopilotPrincipal(principal) ? rows.length : result.rowCount,
+        rows: rowsForReader(principal, rows),
+        ...(input.includePersistedSecretProvenance && readProvenance
+          ? { secretProvenance: readProvenance.exportProvenance() }
+          : {}),
       }
     } catch (error) {
       rethrowQueryValidation(error)
@@ -692,6 +721,7 @@ export const readTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: ReadTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<ReadTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -708,14 +738,16 @@ export const readTableRow = defineAuthorizedTableUseCase({
           budgetBytes: TABLE_LIMITS.MAX_ROW_RUN_STATE_BYTES,
         })
       : undefined
+    if ((await deliverRows(principal, readProvenance, [row])).length === 0) {
+      throw new ContentRefusedError('table-row')
+    }
     return {
       table: context.table,
       row,
-      ...(runState ? { runState } : {}),
-      secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-        include: input.includePersistedSecretProvenance,
-        unprovenancedErrorText: runState !== undefined && runStateHasErrorText(runState),
-      }),
+      ...(runState ? { runState: runStateForReader(principal, runState) } : {}),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
 })
@@ -753,6 +785,7 @@ export const readTableRowEnrichmentDetail = defineAuthorizedTableUseCase({
     resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<ReadTableRowEnrichmentResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId)
     )
@@ -774,17 +807,15 @@ export const readTableRowEnrichmentDetail = defineAuthorizedTableUseCase({
       loadEnrichmentDetail(db, context.tableId, input.rowId, input.groupId),
     ])
     const runState = executions[input.groupId] ?? null
-    await deliverRowsProvenance(readProvenance, [row], {
-      unprovenancedErrorText:
-        (runState !== null && executionHasErrorText(runState)) ||
-        enrichmentDetailHasErrorText(detail),
-    })
+    if ((await deliverRows(principal, readProvenance, [row])).length === 0) {
+      throw new ContentRefusedError('table-row')
+    }
     return {
       table: context.table,
       row,
       group,
-      runState,
-      detail,
+      runState: runState && mustClassifyContent(principal) ? withoutErrorText(runState) : runState,
+      detail: enrichmentDetailForReader(principal, detail),
     }
   },
 })
@@ -830,6 +861,7 @@ export const createTableRows = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: CreateTableRowsInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<CreateTableRowsResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -878,13 +910,14 @@ export const createTableRows = defineAuthorizedTableUseCase({
         requestId(input),
         writeOptions
       )
+      await deliverRows(principal, readProvenance, [row], { written: true })
       return {
         kind: 'single',
         table: context.table,
         row,
-        secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-          include: input.includePersistedSecretProvenance,
-        }),
+        ...(input.includePersistedSecretProvenance && readProvenance
+          ? { secretProvenance: readProvenance.exportProvenance() }
+          : {}),
       }
     }
     if (input.rows.length < 1 || input.rows.length > TABLE_LIMITS.MAX_BATCH_INSERT_SIZE) {
@@ -933,13 +966,14 @@ export const createTableRows = defineAuthorizedTableUseCase({
       requestId(input),
       batchWriteOptions
     )
+    await deliverRows(principal, readProvenance, created, { written: true })
     return {
       kind: 'batch',
       table: context.table,
       rows: created,
-      secretProvenance: await deliverRowsProvenance(readProvenance, created, {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => {
@@ -1244,6 +1278,7 @@ export const updateTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: UpdateTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<UpdateTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -1271,13 +1306,14 @@ export const updateTableRow = defineAuthorizedTableUseCase({
       { ...rowWriteOptions(input), readProvenance }
     )
     if (!row) throw new Error('Unconditional table row update was rejected')
+    await deliverRows(principal, readProvenance, [row], { written: true })
     return {
       table: context.table,
       row,
       changed: Object.keys(data).length > 0,
-      secretProvenance: await deliverRowsProvenance(readProvenance, [row], {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => {
@@ -1327,10 +1363,15 @@ export const updateTableRows = defineAuthorizedTableUseCase({
         input,
         storageData: data,
       })
+      const filter = tableFilterToStorage(
+        input.filter,
+        context.table,
+        input.filterKeying ?? 'names'
+      )
       const result = await updateRowsByFilter(
         context.table,
         {
-          filter: tableFilterToStorage(input.filter, context.table, input.filterKeying ?? 'names'),
+          filter,
           data,
           limit: input.limit,
           actorUserId: actorUserId(principal, context.billedAccountUserId),
@@ -1535,10 +1576,15 @@ export const deleteTableRows = defineAuthorizedTableUseCase({
       if (input.limit !== undefined) {
         requireIntegerInRange(input.limit, 1, TABLE_LIMITS.MAX_BULK_OPERATION_SIZE, 'Limit')
       }
+      const filter = tableFilterToStorage(
+        input.filter,
+        context.table,
+        input.filterKeying ?? 'names'
+      )
       const result = await deleteRowsByFilter(
         context.table,
         {
-          filter: tableFilterToStorage(input.filter, context.table, input.filterKeying ?? 'names'),
+          filter,
           limit: input.limit,
         },
         requestId(input)
@@ -1594,6 +1640,7 @@ export const upsertTableRow = defineAuthorizedTableUseCase({
   resolveContext: ({ input }: { input: UpsertTableRowInput }) => resolveActiveTableContext(input),
   async execute({ principal, input, context }): Promise<UpsertTableRowResult> {
     const readProvenance = createAuthorizedRowsProvenanceReader(
+      principal,
       context.workspaceId,
       actorUserId(principal, context.billedAccountUserId),
       input.includePersistedSecretProvenance
@@ -1626,13 +1673,14 @@ export const upsertTableRow = defineAuthorizedTableUseCase({
       requestId(input),
       { ...rowWriteOptions(input), readProvenance }
     )
+    await deliverRows(principal, readProvenance, [result.row], { written: true })
     return {
       table: context.table,
       row: result.row,
       operation: result.operation,
-      secretProvenance: await deliverRowsProvenance(readProvenance, [result.row], {
-        include: input.includePersistedSecretProvenance,
-      }),
+      ...(input.includePersistedSecretProvenance && readProvenance
+        ? { secretProvenance: readProvenance.exportProvenance() }
+        : {}),
     }
   },
   projectAudit: ({ context, result }) => ({
diff --git a/apps/sim/lib/table/import-data.ts b/apps/sim/lib/table/import-data.ts
index e8b52936d39..fc5276a6c28 100644
--- a/apps/sim/lib/table/import-data.ts
+++ b/apps/sim/lib/table/import-data.ts
@@ -12,6 +12,7 @@ import { and, eq } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { assertRowCapacity, notifyTableRowUsage } from '@/lib/table/billing'
 import { CSV_MAX_BATCH_SIZE } from '@/lib/table/import'
+import type { ImportedRowProvenance } from '@/lib/table/import-provenance'
 import { assertRowDelete, assertRowInsert, assertSchemaMutable } from '@/lib/table/mutation-locks'
 import { nKeysBetween } from '@/lib/table/order-key'
 import type { DbTransaction } from '@/lib/table/planner'
@@ -50,6 +51,10 @@ export interface BulkImportBatch {
   startPosition: number
   /** Previous batch's last `order_key` (the append anchor); null for the first batch / empty table. */
   afterOrderKey?: string | null
+  /** Provenance each row inherits from its source; absent, rows are exact-empty. */
+  rowProvenance?: ImportedRowProvenance
+  /** Each row's cells as the source held them, aligned with `rows`; see `importedRowSources`. */
+  rowSources?: readonly RowData[]
 }
 
 /**
@@ -145,9 +150,11 @@ export async function bulkInsertImportBatch(
       }
     }
     return mutateTableRowsWithSecretProvenance(trx, {
-      rows: rowsToInsert.map((row) => ({
+      rows: rowsToInsert.map((row, index) => ({
         rowId: row.id,
-        provenance: createExactEmptyTableRowSecretProvenance(row.data),
+        provenance: data.rowProvenance
+          ? data.rowProvenance(row.data, data.rowSources?.[index])
+          : createExactEmptyTableRowSecretProvenance(row.data),
       })),
       rowState: 'new',
       mode: 'replace',
diff --git a/apps/sim/lib/table/import-provenance.integration.ts b/apps/sim/lib/table/import-provenance.integration.ts
new file mode 100644
index 00000000000..40ba3e4425c
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.integration.ts
@@ -0,0 +1,187 @@
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { db } from '@sim/db'
+import {
+  auditLog,
+  tableJobs,
+  user,
+  userStats,
+  userTableDefinitions,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { tableBillingMock, tableBillingMockFns } from '@sim/testing/mocks/table-billing.mock'
+import { tableEventsMock } from '@sim/testing/mocks/table-events.mock'
+import { tableTriggerMock } from '@sim/testing/mocks/table-trigger.mock'
+import { tableWorkflowColumnsMock } from '@sim/testing/mocks/table-workflow-columns.mock'
+import { generateId } from '@sim/utils/id'
+import { eq } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const storage = vi.hoisted(() => ({ root: '' }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return storage.root
+  },
+}))
+vi.mock('@/lib/table/billing', () => tableBillingMock)
+vi.mock('@/lib/table/events', () => tableEventsMock)
+vi.mock('@/lib/table/trigger', () => tableTriggerMock)
+vi.mock('@/lib/table/workflow-columns', () => tableWorkflowColumnsMock)
+
+import { encryptSecret } from '@/lib/core/security/encryption'
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { runTableImport } from '@/lib/table/import-runner'
+import { markTableJobRunningInWorkspace } from '@/lib/table/jobs/service'
+import { TableRowProvenanceReader } from '@/lib/table/rows/secret-provenance'
+import { queryRows } from '@/lib/table/rows/service'
+import { getTableById } from '@/lib/table/service'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/** Whitespace is part of this recorded value, not a new matching normalization. */
+const SECRET = '  csv-source-secret-012345  '
+const PADDED_SHORT = ['        x', 'x        ', '    x    ']
+const QUOTED_OVERLAP = `${SECRET.trimStart()} | ${SECRET} | ${SECRET.trimEnd()}`
+const ORDINARY_VALUES: Record<string, string> = {
+  clean: 'ordinary value',
+  skipped: 'visible',
+  'short-prefix': 'xylophone',
+  'short-suffix': 'phoenix',
+  'short-whole': 'x',
+}
+
+describe('stored CSV imports preserve lineage through parsing and persistence', () => {
+  const userId = generateId()
+  const workspaceId = generateId()
+
+  beforeAll(async () => {
+    storage.root = mkdtempSync(path.join(tmpdir(), 'sim-import-lineage-'))
+    tableBillingMockFns.mockAssertRowCapacity.mockResolvedValue(10_000)
+    await db.insert(user).values({
+      id: userId,
+      name: 'CSV lineage fixture',
+      email: `${userId}@csv-lineage.test`,
+      emailVerified: true,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    })
+    await db.insert(userStats).values({ id: generateId(), userId })
+    await insertWorkspaceFixture(db, {
+      id: workspaceId,
+      name: 'CSV lineage fixture',
+      ownerId: userId,
+      billedAccountUserId: userId,
+    })
+  })
+
+  afterAll(async () => {
+    await db.delete(auditLog).where(eq(auditLog.workspaceId, workspaceId))
+    await deleteWorkspaceFixture(db, eq(workspace.id, workspaceId))
+    await db.delete(user).where(eq(user.id, userId))
+    await rm(storage.root, { recursive: true, force: true })
+  })
+
+  it('protects a trimmed source value while preserving quoted, clean and skipped cells', async () => {
+    const tableId = generateId()
+    const importId = generateId()
+    await db.insert(userTableDefinitions).values({
+      id: tableId,
+      workspaceId,
+      name: tableId,
+      createdBy: userId,
+      schema: {
+        columns: [
+          { id: 'kind', name: 'kind', type: 'string' },
+          { id: 'value', name: 'value', type: 'string' },
+        ],
+      },
+    })
+    const source = await uploadWorkspaceFile(
+      workspaceId,
+      userId,
+      Buffer.from(
+        'kind,value,ignored\r\n' +
+          `trimmed,${SECRET},none\r\n` +
+          `quoted,"${SECRET}",none\r\n` +
+          `quoted-overlap,"${QUOTED_OVERLAP}",none\r\n` +
+          `short-prefix,xylophone,"${PADDED_SHORT[0]}"\r\n` +
+          `short-suffix,phoenix,"${PADDED_SHORT[1]}"\r\n` +
+          `short-whole,x,"${PADDED_SHORT[2]}"\r\n` +
+          'clean,  ordinary value  ,none\r\n' +
+          `skipped,visible,"${SECRET}"\r\n` +
+          `"multiline,\nquoted",${SECRET},none\r\n`
+      ),
+      `${importId}.csv`,
+      'text/csv',
+      {
+        secretProvenance: {
+          status: 'exact',
+          entries: [
+            {
+              name: 'CSV_SOURCE',
+              encryptedValue: (await encryptSecret(SECRET)).encrypted,
+              sourceUserId: userId,
+              sourceWorkspaceId: workspaceId,
+            },
+            ...(await Promise.all(
+              PADDED_SHORT.map(async (value, index) => ({
+                name: `PADDED_${index}`,
+                encryptedValue: (await encryptSecret(value)).encrypted,
+                sourceUserId: userId,
+                sourceWorkspaceId: workspaceId,
+              }))
+            )),
+          ],
+        },
+        notifyWorkspaceChange: false,
+      }
+    )
+    expect(await markTableJobRunningInWorkspace(tableId, workspaceId, importId, 'import')).toBe(
+      true
+    )
+    await runTableImport({
+      importId,
+      tableId,
+      workspaceId,
+      userId,
+      fileKey: source.key,
+      fileName: source.name,
+      delimiter: ',',
+      mode: 'append',
+      mapping: { kind: 'kind', value: 'value', ignored: null },
+      deleteSourceFile: false,
+    })
+    const [job] = await db.select().from(tableJobs).where(eq(tableJobs.id, importId))
+    expect(job).toMatchObject({ status: 'ready', rowsProcessed: 9, error: null })
+    const reader = new TableRowProvenanceReader({ userId, workspaceId })
+    const table = await getTableById(tableId)
+    if (!table) throw new Error('Imported fixture table disappeared')
+    const result = await queryRows(table, { limit: 10 }, generateId(), reader)
+    expect(result.rows).toHaveLength(9)
+    for (const row of result.rows) {
+      const provenance = reader.rowProvenance(row.id)
+      if (row.data.kind === 'trimmed' || row.data.kind === 'multiline,\nquoted') {
+        expect(row.data.value).toBe(SECRET.trim())
+        expect(provenance).toEqual({ status: 'unknown' })
+      } else if (row.data.kind === 'quoted' || row.data.kind === 'quoted-overlap') {
+        const expected = row.data.kind === 'quoted' ? SECRET : QUOTED_OVERLAP
+        expect(row.data.value).toBe(expected)
+        expect.soft(provenance.status).toBe('exact')
+        if (provenance.status !== 'exact') continue
+        const registry = new ResolvedSecretTraceRegistry([], { userId, workspaceId })
+        expect(await importDurableSecretProvenance(registry, provenance)).toBe(true)
+        expect(projectResolvedSecretModelContent(row.data.value, registry)).toEqual({
+          safe: true,
+          value: expected.replace(SECRET, '{{CSV_SOURCE}}'),
+        })
+      } else {
+        expect(row.data.value).toBe(ORDINARY_VALUES[String(row.data.kind)])
+        expect.soft(provenance).toEqual({ status: 'exact', entries: [] })
+      }
+    }
+  })
+})
diff --git a/apps/sim/lib/table/import-provenance.test.ts b/apps/sim/lib/table/import-provenance.test.ts
new file mode 100644
index 00000000000..69de5ed771c
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.test.ts
@@ -0,0 +1,91 @@
+/**
+ * @vitest-environment node
+ */
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+
+import { importedRowSources, resolveImportedRowProvenance } from '@/lib/table/import-provenance'
+
+/** Leading zeros a number column drops, so the coerced cell no longer holds the secret's text. */
+const SECRET = '0042424242424242'
+const SOURCE = { workspaceId: 'workspace-1', userId: 'user-1', fileKey: 'imports/file.csv' }
+
+function storeSource(provenance: unknown) {
+  workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+    new Map([[SOURCE.fileKey, provenance]])
+  )
+}
+
+beforeEach(() => {
+  encryptionMockFns.mockDecryptSecret.mockImplementation(async (value: string) => ({
+    decrypted: value.slice('enc:'.length),
+  }))
+  storeSource({
+    status: 'exact',
+    entries: [{ name: 'CARD', encryptedValue: `enc:${SECRET}`, sourceUserId: 'user-1' }],
+  })
+})
+
+describe('resolveImportedRowProvenance', () => {
+  it('gives each cell the secrets its stored text contains', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    const row = { c_card: `card ${SECRET}`, c_note: 'plain' }
+    const written = stamp(row, { ...row })
+    expect(written.complete).toBe(true)
+    expect(written.columns.c_card?.entries).toHaveLength(1)
+    expect(written.columns.c_note?.entries).toEqual([])
+  })
+
+  it('makes a row unknown when coercion rewrote a cell that held a secret', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    /** A number column parses the secret; the stored value no longer matches its text. */
+    const written = stamp({ c_card: Number(SECRET) }, { c_card: SECRET })
+    expect(written.complete).toBe(false)
+  })
+
+  it('keeps a row exact when coercion rewrote only cells without secrets', async () => {
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    const written = stamp({ c_count: 7, c_empty: null }, { c_count: '7', c_empty: `x ${SECRET}` })
+    expect(written.complete).toBe(true)
+  })
+
+  it.each([
+    ['a clean file', { status: 'exact', entries: [] }],
+    ['an unrecorded file', { status: 'unrecorded' }],
+    ['a key no file names', undefined],
+  ])('keeps rows from %s exact-empty, as before', async (_case, provenance) => {
+    storeSource(provenance)
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    expect(stamp({ c_card: 7 }, { c_card: SECRET })).toEqual({
+      complete: true,
+      columns: { c_card: { version: 1, complete: true, entries: [] } },
+    })
+  })
+
+  it('makes every row from an unknown file unknown', async () => {
+    storeSource({ status: 'unknown' })
+    const stamp = await resolveImportedRowProvenance(SOURCE)
+    expect(stamp({ c_note: 'plain' }, { c_note: 'plain' }).complete).toBe(false)
+  })
+})
+
+describe('importedRowSources', () => {
+  it('keys each raw cell by the column id its header maps to', () => {
+    const sources = importedRowSources(
+      [{ Amount: '12.50', Ignored: 'x' }],
+      { columns: [{ id: 'col_amount', name: 'amount', type: 'number' }] },
+      new Map([['Amount', 'amount']])
+    )
+    expect(sources).toEqual([{ col_amount: '12.50' }])
+  })
+})
diff --git a/apps/sim/lib/table/import-provenance.ts b/apps/sim/lib/table/import-provenance.ts
new file mode 100644
index 00000000000..6353d36775e
--- /dev/null
+++ b/apps/sim/lib/table/import-provenance.ts
@@ -0,0 +1,117 @@
+import { importDurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
+import { getColumnId } from '@/lib/table/column-keys'
+import {
+  createExactEmptyTableRowSecretProvenance,
+  createTableRowSecretProvenanceFromRegistry,
+  createUnknownTableRowSecretProvenance,
+} from '@/lib/table/rows/secret-provenance'
+import type { RowData, TableRowSecretProvenanceWrite, TableSchema } from '@/lib/table/types'
+import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { isNonIdentifyingSecretLiteral } from '@/executor/utils/resolved-secret-match-policy'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+/**
+ * Stamps each imported row with the provenance its cells inherit from the source file. `source`
+ * holds parsed CSV cells, keyed by column id, before column coercion rewrote any value.
+ */
+export type ImportedRowProvenance = (
+  row: RowData,
+  source?: RowData
+) => TableRowSecretProvenanceWrite
+
+/**
+ * The provenance every row of an import inherits from the stored file it reads, resolved by the
+ * storage key the import streams, so a job queued before this existed is covered too. A source
+ * whose provenance is unknown makes every row unknown: the import still succeeds for every caller,
+ * and only reads that classify content (Chat's) refuse those rows. A source holding secrets gives
+ * each cell exactly the secrets its own value contains. A key no file names (a direct upload), or
+ * a file with no recorded secrets, keeps the exact-empty rows every import has always written.
+ */
+export async function resolveImportedRowProvenance(source: {
+  workspaceId: string
+  userId?: string
+  fileKey: string
+}): Promise<ImportedRowProvenance> {
+  const provenance = (
+    await getStoredFileSecretProvenanceByKey(source.workspaceId, [source.fileKey])
+  ).get(source.fileKey)
+  if (!provenance) return createExactEmptyTableRowSecretProvenance
+  if (provenance.status === 'unknown') return createUnknownTableRowSecretProvenance
+  if (provenance.status === 'unrecorded' || provenance.entries.length === 0) {
+    return createExactEmptyTableRowSecretProvenance
+  }
+  const registry = new ResolvedSecretTraceRegistry(
+    [],
+    source.userId ? { userId: source.userId, workspaceId: source.workspaceId } : undefined
+  )
+  if (!(await importDurableSecretProvenance(registry, provenance))) {
+    return createUnknownTableRowSecretProvenance
+  }
+  const snapshot = registry.getModelEgressSnapshot()
+  if (!snapshot.complete) return createUnknownTableRowSecretProvenance
+  const trimmedCandidates = snapshot.matches.flatMap(({ plaintext }) => {
+    const start = plaintext.trimStart()
+    const end = plaintext.trimEnd()
+    const whole = plaintext.trim()
+    const candidate = {
+      plaintext,
+      start: start !== plaintext && !isNonIdentifyingSecretLiteral(start) ? start : undefined,
+      end: end !== plaintext && !isNonIdentifyingSecretLiteral(end) ? end : undefined,
+      whole:
+        start !== plaintext && end !== plaintext && !isNonIdentifyingSecretLiteral(whole)
+          ? whole
+          : undefined,
+    }
+    return candidate.start || candidate.end || candidate.whole ? [candidate] : []
+  })
+  return (row, source) => {
+    /**
+     * Coercion can rewrite a secret (a number parsed, a date normalized) into text redaction no
+     * longer matches; such a row cannot be vouched for cell by cell, so it is unknown.
+     */
+    for (const [columnId, raw] of Object.entries(source ?? {})) {
+      const stored = row[columnId]
+      if (stored === null || stored === undefined) continue
+      /** CSV trims unquoted field edges before coercion sees them; source candidates stay exact. */
+      if (
+        typeof raw === 'string' &&
+        trimmedCandidates.some(
+          ({ plaintext, start, end, whole }) =>
+            !raw.includes(plaintext) &&
+            ((start !== undefined && raw.startsWith(start)) ||
+              (end !== undefined && raw.endsWith(end)) ||
+              (whole !== undefined && raw === whole))
+        )
+      ) {
+        return createUnknownTableRowSecretProvenance()
+      }
+      if (Object.is(stored, raw)) continue
+      const rawProvenance = registry.exportCommittedProvenanceForValue(raw)
+      if (!rawProvenance.complete || rawProvenance.entries.length > 0) {
+        return createUnknownTableRowSecretProvenance()
+      }
+    }
+    return createTableRowSecretProvenanceFromRegistry(row, registry)
+  }
+}
+
+/**
+ * Parsed cells before column coercion, keyed by the column id it writes and aligned with
+ * what `coerceRowsForTable` returns for the same rows.
+ */
+export function importedRowSources(
+  rows: readonly Record<string, unknown>[],
+  schema: TableSchema,
+  headerToColumn: ReadonlyMap<string, string>
+): RowData[] {
+  const columnIdByName = new Map(schema.columns.map((column) => [column.name, getColumnId(column)]))
+  return rows.map((row) => {
+    const source: RowData = {}
+    for (const [header, value] of Object.entries(row)) {
+      const columnName = headerToColumn.get(header)
+      const columnId = columnName === undefined ? undefined : columnIdByName.get(columnName)
+      if (columnId !== undefined) source[columnId] = value as RowData[string]
+    }
+    return source
+  })
+}
diff --git a/apps/sim/lib/table/import-runner.ts b/apps/sim/lib/table/import-runner.ts
index 14a8c336e5f..dd4efa4fd2d 100644
--- a/apps/sim/lib/table/import-runner.ts
+++ b/apps/sim/lib/table/import-runner.ts
@@ -29,6 +29,7 @@ import {
   deleteAllTableRows,
   setTableSchemaForImport,
 } from '@/lib/table/import-data'
+import { importedRowSources, resolveImportedRowProvenance } from '@/lib/table/import-provenance'
 import { createCsvParser } from '@/lib/table/import-stream'
 import {
   markJobFailedInWorkspace,
@@ -162,6 +163,9 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
     // the local dev provider, in which case the bar stays indeterminate (rows still show).
     const totalBytes = (await headObject(fileKey, storageContext))?.size ?? 0
 
+    /** Classified before a byte is read, by the key streamed below; see the resolver. */
+    const rowProvenance = await resolveImportedRowProvenance({ workspaceId, userId, fileKey })
+
     // Stream the file rather than buffering it — a ~1M-row import must never be held in memory.
     source = await downloadFileStream({ key: fileKey, context: storageContext })
 
@@ -319,6 +323,8 @@ export async function runTableImport(payload: TableImportPayload): Promise<void>
           rows: coerced,
           startPosition: basePosition + inserted,
           afterOrderKey: lastOrderKey,
+          rowProvenance,
+          rowSources: importedRowSources(rows, schema, headerToColumn),
         },
         { ...table, schema },
         requestId,
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index 7e38aab43e9..1d49c72e252 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -8,6 +8,7 @@ import { createLogger } from '@sim/logger'
 import { isRecordLike } from '@sim/utils/object'
 import { compareStrings } from '@sim/utils/string'
 import { and, asc, eq, gt, inArray, type SQL, sql } from 'drizzle-orm'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import { SecretProvenanceBudget } from '@/lib/execution/provenance-budget'
 import {
   PROVENANCE_MAX_ENTRIES,
@@ -865,38 +866,25 @@ function createStoredEntryAggregator(scope: ResolvedSecretTraceScopeV1) {
   }
 }
 
+type TableRowClassification =
+  | { status: 'exact'; entries: StoredTableRowSecretProvenanceEntry[] }
+  | { status: 'unknown'; cause: string }
+
 /**
- * Builds one bounded provenance envelope for rows crossing an authenticated
- * internal table boundary. Untracked legacy rows contribute an exact-empty
- * report; tracked missing, stale, or malformed sidecars make the report
- * incomplete without inspecting configured secret plaintext.
+ * Classifies each crossing row on its own, against its sidecar at the revision that was read:
+ * untracked legacy rows are exact-empty; a missing, stale, malformed, or non-exact sidecar, or a
+ * row read twice at different revisions, is unknown. Entries are narrowed to the columns crossing.
  */
-export async function loadTableRowSecretProvenance(
+async function classifyTableRowCrossings(
   rows: TableRowCrossing[],
-  scope: ResolvedSecretTraceScopeV1,
-  executor: DbExecutor = db
-): Promise<ResolvedSecretTraceProvenanceV1> {
-  if (rows.length === 0) {
-    return { version: 1, complete: true, entries: [], scope }
-  }
-
-  const incomplete = (cause: string): ResolvedSecretTraceProvenanceV1 => {
-    logger.error('Table row read could not establish secret provenance', {
-      surface: 'table-row',
-      cause,
-      rowCount: rows.length,
-      workspaceId: scope.workspaceId,
-      actorUserId: scope.userId,
-    })
-    return { version: 1, complete: false, entries: [], scope }
-  }
-
-  const crossingById = new Map<string, TableRowCrossing & { selectedColumnIds?: Set<string> }>()
+  executor: DbExecutor
+): Promise<Map<string, TableRowClassification>> {
+  const crossingById = new Map<
+    string,
+    TableRowCrossing & { selectedColumnIds?: Set<string>; conflicting?: boolean }
+  >()
   for (const row of rows) {
     const existing = crossingById.get(row.id)
-    if (existing && !sameTimestamp(existing.updatedAt, row.updatedAt)) {
-      return incomplete('duplicate-row-revision')
-    }
     const selectedColumnIds = row.selectedValues
       ? new Set(Object.keys(row.selectedValues))
       : undefined
@@ -904,40 +892,119 @@ export async function loadTableRowSecretProvenance(
       crossingById.set(row.id, { ...row, selectedColumnIds })
       continue
     }
+    if (!sameTimestamp(existing.updatedAt, row.updatedAt)) existing.conflicting = true
     if (!existing.selectedColumnIds || !selectedColumnIds) {
       existing.selectedColumnIds = undefined
       continue
     }
     for (const columnId of selectedColumnIds) existing.selectedColumnIds.add(columnId)
   }
-  const rowIds = [...crossingById.keys()]
-  const currentRows = await selectRowsWithSidecars(executor, rowIds)
+  const currentRows = await selectRowsWithSidecars(
+    executor,
+    [...crossingById.values()].filter((row) => !row.conflicting).map((row) => row.id)
+  )
   const currentById = new Map(currentRows.map((row) => [row.id, row]))
-  const aggregator = createStoredEntryAggregator(scope)
-
-  for (const rowId of rowIds) {
+  const result = new Map<string, TableRowClassification>()
+  for (const [rowId, crossing] of crossingById) {
     const current = currentById.get(rowId)
-    const crossing = crossingById.get(rowId)
-    if (!current || !crossing) return incomplete('row-missing')
+    if (crossing.conflicting) {
+      result.set(rowId, { status: 'unknown', cause: 'duplicate-row-revision' })
+      continue
+    }
+    if (!current) {
+      result.set(rowId, { status: 'unknown', cause: 'row-missing' })
+      continue
+    }
     if (!sameTimestamp(current.updatedAt, crossing.updatedAt)) {
-      return incomplete('row-revision-mismatch')
+      result.set(rowId, { status: 'unknown', cause: 'row-revision-mismatch' })
+      continue
+    }
+    if (current.secretProvenanceVersion === null) {
+      result.set(rowId, { status: 'exact', entries: [] })
+      continue
     }
-    if (current.secretProvenanceVersion === null) continue
     if (
       current.secretProvenanceVersion !== TABLE_ROW_SECRET_PROVENANCE_VERSION ||
       current.sidecarStatus !== 'exact' ||
       !current.sidecarIsCurrent
     ) {
-      return incomplete('row-sidecar-not-exact')
+      result.set(rowId, { status: 'unknown', cause: 'row-sidecar-not-exact' })
+      continue
     }
     const parsed = normalizeStoredEntries(current.sidecarEntries)
-    if (!parsed) return incomplete('row-sidecar-malformed')
-    for (const entry of parsed) {
-      if (crossing.selectedColumnIds && !crossing.selectedColumnIds.has(entry.columnId)) continue
-      if (!aggregator.add(entry)) return incomplete('row-provenance-budget-exceeded')
+    if (!parsed) {
+      result.set(rowId, { status: 'unknown', cause: 'row-sidecar-malformed' })
+      continue
     }
+    result.set(rowId, {
+      status: 'exact',
+      entries: parsed.filter(
+        (entry) => !crossing.selectedColumnIds || crossing.selectedColumnIds.has(entry.columnId)
+      ),
+    })
   }
+  return result
+}
 
+/**
+ * Builds one bounded provenance envelope for rows crossing an authenticated
+ * internal table boundary. Untracked legacy rows contribute an exact-empty
+ * report; tracked missing, stale, or malformed sidecars make the report
+ * incomplete without inspecting configured secret plaintext.
+ */
+export async function loadTableRowSecretProvenance(
+  rows: TableRowCrossing[],
+  scope: ResolvedSecretTraceScopeV1,
+  executor: DbExecutor = db
+): Promise<ResolvedSecretTraceProvenanceV1> {
+  if (rows.length === 0) {
+    return { version: 1, complete: true, entries: [], scope }
+  }
+  /** One envelope covers every row, so a row read at two revisions settles it unread. */
+  const revisions = new Map<string, TableRowCrossing['updatedAt']>()
+  const conflicting = rows.some((row) => {
+    const seen = revisions.get(row.id)
+    revisions.set(row.id, row.updatedAt)
+    return seen !== undefined && !sameTimestamp(seen, row.updatedAt)
+  })
+  if (conflicting) {
+    return envelopeFromClassifications(
+      new Map<string, TableRowClassification>([
+        ['', { status: 'unknown', cause: 'duplicate-row-revision' }],
+      ]),
+      rows.length,
+      scope
+    )
+  }
+  return envelopeFromClassifications(
+    await classifyTableRowCrossings(rows, executor),
+    rows.length,
+    scope
+  )
+}
+
+function envelopeFromClassifications(
+  classifications: ReadonlyMap<string, TableRowClassification>,
+  rowCount: number,
+  scope: ResolvedSecretTraceScopeV1
+): ResolvedSecretTraceProvenanceV1 {
+  const incomplete = (cause: string): ResolvedSecretTraceProvenanceV1 => {
+    logger.error('Table row read could not establish secret provenance', {
+      surface: 'table-row',
+      cause,
+      rowCount,
+      workspaceId: scope.workspaceId,
+      actorUserId: scope.userId,
+    })
+    return { version: 1, complete: false, entries: [], scope }
+  }
+  const aggregator = createStoredEntryAggregator(scope)
+  for (const classification of classifications.values()) {
+    if (classification.status === 'unknown') return incomplete(classification.cause)
+    for (const entry of classification.entries) {
+      if (!aggregator.add(entry)) return incomplete('row-provenance-budget-exceeded')
+    }
+  }
   const entries = aggregator.build()
   if (!entries) return incomplete('row-provenance-budget-exceeded')
   const provenance: ResolvedSecretTraceProvenanceV1 = {
@@ -960,6 +1027,8 @@ export async function loadTableRowSecretProvenance(
  */
 export class TableRowProvenanceReader {
   private readonly accumulator: ResolvedSecretTraceProvenanceAccumulator
+  /** Every row captured, classified on its own. A row never captured has no classification. */
+  private readonly rows = new Map<string, DurableSecretProvenance>()
 
   constructor(
     private readonly scope: ResolvedSecretTraceScopeV1,
@@ -972,26 +1041,44 @@ export class TableRowProvenanceReader {
     executor: DbExecutor,
     rows: { id: string; updatedAt: Date | string; data: unknown }[]
   ): Promise<void> {
-    this.accumulator.record(
-      await loadTableRowSecretProvenance(
-        rows.map((row) => {
-          const data = row.data as RowData
-          let selectedValues = data
-          if (this.selectedColumnIds) {
-            selectedValues = {}
-            for (const columnId of this.selectedColumnIds) {
-              if (Object.hasOwn(data, columnId)) selectedValues[columnId] = data[columnId]
-            }
+    if (rows.length === 0) {
+      this.accumulator.record({ version: 1, complete: true, entries: [], scope: this.scope })
+      return
+    }
+    const classifications = await classifyTableRowCrossings(
+      rows.map((row) => {
+        const data = row.data as RowData
+        let selectedValues = data
+        if (this.selectedColumnIds) {
+          selectedValues = {}
+          for (const columnId of this.selectedColumnIds) {
+            if (Object.hasOwn(data, columnId)) selectedValues[columnId] = data[columnId]
           }
-          return { id: row.id, updatedAt: row.updatedAt, selectedValues }
-        }),
-        this.scope,
-        executor
-      )
+        }
+        return { id: row.id, updatedAt: row.updatedAt, selectedValues }
+      }),
+      executor
     )
+    for (const [rowId, classification] of classifications) {
+      this.rows.set(
+        rowId,
+        classification.status === 'unknown'
+          ? { status: 'unknown' }
+          : {
+              status: 'exact',
+              entries: classification.entries.map(({ columnId: _column, ...entry }) => entry),
+            }
+      )
+    }
+    this.accumulator.record(envelopeFromClassifications(classifications, rows.length, this.scope))
   }
 
   exportProvenance(): ResolvedSecretTraceProvenanceV1 {
     return this.accumulator.exportProvenance()
   }
+
+  /** One captured row's classification; a row this reader never captured is unknown. */
+  rowProvenance(rowId: string): DurableSecretProvenance {
+    return this.rows.get(rowId) ?? { status: 'unknown' }
+  }
 }
diff --git a/apps/sim/lib/table/rows/service.ts b/apps/sim/lib/table/rows/service.ts
index 62d70d4e839..b0ce412afdc 100644
--- a/apps/sim/lib/table/rows/service.ts
+++ b/apps/sim/lib/table/rows/service.ts
@@ -1098,7 +1098,10 @@ export async function findRowMatches(
   table: TableDefinition,
   options: { q: string; filter?: Filter; sort?: Sort },
   requestId: string
-): Promise<{ matches: FindRowMatch[]; truncated: boolean }> {
+): Promise<{
+  matches: FindRowMatch[]
+  truncated: boolean
+}> {
   const tableName = USER_TABLE_ROWS_SQL_NAME
   const columns = table.schema.columns
   // Row data is keyed by stable column id, so scan/return JSONB keys as ids.
diff --git a/apps/sim/lib/tool-execution/application/execute-tool.ts b/apps/sim/lib/tool-execution/application/execute-tool.ts
index 9612a06e772..ff672cbcabe 100644
--- a/apps/sim/lib/tool-execution/application/execute-tool.ts
+++ b/apps/sim/lib/tool-execution/application/execute-tool.ts
@@ -13,15 +13,21 @@ import {
   resolveVisibleToolId,
   resolveVisibleToolOwners,
 } from '@/lib/catalog/application/tool-scope'
-import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
+import {
+  admitWrittenContent,
+  defineAuthorizedWorkspaceUseCase,
+  mustClassifyContent,
+} from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getEffectiveDecryptedEnv } from '@/lib/environment/utils'
+import { durableSecretProvenanceFromRegistry } from '@/lib/execution/durable-secret-provenance'
 import { principalUserId } from '@/lib/integrations/principal-scope.server'
 import { toolExecutionOperations } from '@/lib/tool-execution/application/operations'
 import { isEnvVarReference } from '@/executor/constants'
 import { resolveEnvVarReferences } from '@/executor/utils/reference-validation'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { executeTool as executeRegistryTool } from '@/tools'
 import type { ExecutableToolConfig } from '@/tools/types'
 import { getTool } from '@/tools/utils'
@@ -344,6 +350,10 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
       throw new OrchestrationError('forbidden', 'Tool execution requires an acting user')
     }
 
+    const registry = mustClassifyContent(principal)
+      ? new ResolvedSecretTraceRegistry([], { userId, workspaceId: context.workspaceId })
+      : undefined
+
     const billingAttribution = await resolveBillingAttribution({
       actorUserId: userId,
       workspaceId: context.workspaceId,
@@ -395,6 +405,7 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
     const callId = generateId()
 
     const result = await executeRegistryTool(toolId, params, {
+      resolvedSecretTraceRegistry: registry,
       signal: AbortSignal.timeout((input.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1000),
       operationContext: {
         /**
@@ -405,6 +416,7 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
          */
         workflowId: '',
         callerPrincipal: principal,
+        resolvedSecretTraceRegistry: registry,
         userId,
         workspaceId: context.workspaceId,
         billingAttribution,
@@ -442,6 +454,20 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
       })
     }
 
+    await admitWrittenContent(
+      principal,
+      registry
+        ? [
+            {
+              kind: 'tool-result',
+              id: callId,
+              provenance: durableSecretProvenanceFromRegistry(registry, result),
+              view: 'complete',
+            },
+          ]
+        : []
+    )
+
     return {
       toolId,
       status: result.success ? 'succeeded' : 'failed',
diff --git a/apps/sim/lib/tool-execution/application/operations.ts b/apps/sim/lib/tool-execution/application/operations.ts
index 3dbe325c164..b29bd05d233 100644
--- a/apps/sim/lib/tool-execution/application/operations.ts
+++ b/apps/sim/lib/tool-execution/application/operations.ts
@@ -37,5 +37,6 @@ export const toolExecutionOperations = {
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'sourced',
   }),
 } as const
diff --git a/apps/sim/lib/uploads/contexts/organization-assistant/application.ts b/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
index a3b85aa3518..3f35a04e310 100644
--- a/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
+++ b/apps/sim/lib/uploads/contexts/organization-assistant/application.ts
@@ -128,6 +128,7 @@ export async function finalizeOrganizationAssistantAttachment(
 
 const organizationAttachmentReadOperation = defineOrganizationOperation({
   id: 'organization.chat.attachments.read',
+  contentDelivery: 'none',
   minimumRole: 'member',
   capability: 'copilot.use',
   principalKinds: ['session', 'organization_delegated'],
diff --git a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
index 361c892e259..f5717820a0c 100644
--- a/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts
@@ -28,13 +28,14 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
   },
 }))
 
+import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   createKnowledgeAclFixtureIds,
   seedKnowledgeAclFixture,
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
-import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
 import { runCli } from '@/lib/mothership/agent-cli/run-cli'
+import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
 import { handoffFileCreatorsInTx } from '@/lib/uploads/contexts/workspace/creator-handoff'
 import { WORKSPACE_FILE_STORAGE_CLEANUP_OUTBOX_EVENT } from '@/lib/uploads/contexts/workspace/file-outbox-events'
 import {
@@ -57,13 +58,7 @@ import {
   queryWorkspaceFileVersions,
   releaseWorkspaceFileVersionsForPurgeInTx,
 } from '@/lib/uploads/contexts/workspace/workspace-file-versions'
-import { v2FileErrorPolicies } from '@/lib/workspace-files/api'
-import { presentWorkspaceFileText } from '@/lib/workspace-files/api/text-presenter'
-import {
-  downloadWorkspaceFileVersion,
-  readWorkspaceFileVersionText,
-  revertWorkspaceFileVersion,
-} from '@/lib/workspace-files/application/file-versions'
+import { revertWorkspaceFileVersion } from '@/lib/workspace-files/application/file-versions'
 import { revokeWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-access'
 import { runCleanupFileVersions } from '@/background/cleanup-file-versions'
 import { runCleanupSoftDeletes } from '@/background/cleanup-soft-deletes'
@@ -635,9 +630,8 @@ describe('workspace file version history in PostgreSQL', () => {
     }
   )
 
+  /** Version downloads are direct-only, so Chat reaches history as text. */
   it.each([
-    ['named', 'download'],
-    ['anonymous', 'download'],
     ['named', 'read'],
     ['anonymous', 'read'],
     ['empty', 'read'],
@@ -685,52 +679,30 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const delivered: Array<{
-        stream: ReadableStream<Uint8Array>
-        provenance: WorkspaceFileSecretProvenance | undefined
-      }> = []
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        trackDownload: (stream, provenance) => {
-          delivered.push({ stream, provenance })
-        },
-        transport: async () => {
-          if (command === 'read') {
-            const result = await readWorkspaceFileVersionText.execute({
-              principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-              input: {
-                fileId: fixture.fileId,
-                assertedWorkspaceId: fixture.workspaceId,
-                version: 2,
-              },
-            })
-            return Response.json({
-              data: { ...presentWorkspaceFileText(result).data, version: result.version.version },
-            })
-          }
-          const result = await downloadWorkspaceFileVersion.execute({
-            principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-            input: { fileId: fixture.fileId, assertedWorkspaceId: fixture.workspaceId, version: 2 },
-          })
-          return new Response(result.stream, { headers: { 'content-type': result.contentType } })
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        ['files', 'versions', command, fixture.fileId, '2'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            ['files', 'versions', command, fixture.fileId, '2'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       expect(result.exitCode).toBe(0)
       expect(result.stdout).toContain(historicalContent)
@@ -740,7 +712,6 @@ describe('workspace file version history in PostgreSQL', () => {
       if (hasSecret) expect(projected.value).not.toContain(secret)
       else expect(projected.value).toBe(result.stdout)
       if (kind === 'named') expect(projected.value).toContain('{{FILE_TOKEN}}')
-      expect(delivered.map((delivery) => delivery.provenance)).toEqual([provenance])
     }
   )
 
@@ -781,32 +752,30 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        transport: async () => {
-          const result = await downloadWorkspaceFileVersion.execute({
-            principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-            input: { fileId: fixture.fileId, assertedWorkspaceId: fixture.workspaceId, version: 1 },
-          })
-          return new Response(result.stream, { headers: { 'content-type': result.contentType } })
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        ['files', 'versions', 'download', fixture.fileId, '1'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            ['files', 'versions', 'read', fixture.fileId, '1'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       if (kind === 'legacy') {
         expect(result.exitCode).toBe(0)
@@ -820,7 +789,7 @@ describe('workspace file version history in PostgreSQL', () => {
   )
 
   it.each(['current', 'historical'] as const)(
-    'redacts %s file contents when the real parser includes them in a CLI error',
+    'keeps %s file contents out of a real parser error',
     async (revision) => {
       const fixture = await seedFile('{}', 'json')
       const secret = 'ZZTOKEN99'
@@ -866,54 +835,37 @@ describe('workspace file version history in PostgreSQL', () => {
         userId: fixture.aliceId,
         workspaceId: fixture.workspaceId,
       })
-      const transport = createFileReadTransport({
+      const transport = createAgentCliTransport({
         endpoint: 'https://version-fixture.test',
-        userId: fixture.aliceId,
         registry,
         invocation: {
           userId: fixture.aliceId,
           workspaceId: fixture.workspaceId,
           chatId: 'version-fixture',
         },
-        transport: async () => {
-          try {
-            const result = await readWorkspaceFileVersionText.execute({
-              principal: { kind: 'session', userId: fixture.aliceId, sessionId: generateId() },
-              input: {
-                fileId: fixture.fileId,
-                assertedWorkspaceId: fixture.workspaceId,
-                version: 2,
-              },
-            })
-            return Response.json({
-              data: { ...presentWorkspaceFileText(result).data, version: result.version.version },
-            })
-          } catch (error) {
-            const response = v2FileErrorPolicies.concealResourceAuthorization.render(error)
-            if (!response) throw error
-            return response
-          }
-        },
+        resources: [],
+        observeReads: true,
       })
-      const result = await runCli(
-        revision === 'current'
-          ? ['files', 'read', fixture.fileId]
-          : ['files', 'versions', 'read', fixture.fileId, '2'],
-        {
-          endpoint: 'https://version-fixture.test',
-          apiKey: 'fixture',
-          workspaceId: fixture.workspaceId,
-          transport,
-        },
-        null
+      const result = await withWorkspaceInvocationScope(
+        { workspaceId: fixture.workspaceId, organizationId: fixture.organizationId },
+        () =>
+          runCli(
+            revision === 'current'
+              ? ['files', 'read', fixture.fileId]
+              : ['files', 'versions', 'read', fixture.fileId, '2'],
+            {
+              endpoint: 'https://version-fixture.test',
+              apiKey: 'fixture',
+              workspaceId: fixture.workspaceId,
+              transport,
+            },
+            null
+          )
       )
       expect(result.exitCode).not.toBe(0)
-      expect(result.stderr).toContain(secret)
-      const projected = projectResolvedSecretModelContent(result.stderr, registry)
-      expect(projected.safe).toBe(true)
-      if (!projected.safe) throw new Error('File parser error was withheld')
-      expect(projected.value).not.toContain(secret)
-      expect(projected.value).toContain('{{FILE_TOKEN}}')
+      /** The parser names the failure without quoting the input, so no fragment can survive. */
+      expect(result.stderr).toContain('Invalid JSON')
+      expect(result.stderr).not.toContain(secret)
     }
   )
 
diff --git a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
index cd82e241af9..5fc84fde354 100644
--- a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.ts
@@ -24,6 +24,7 @@ import {
   PROVENANCE_MAX_SERIALIZED_BYTES,
 } from '@/lib/execution/provenance-limits'
 import { findWorkspaceFileVersionKeys } from '@/lib/uploads/contexts/workspace/workspace-file-versions'
+import type { OwnedFileContext } from '@/lib/workspace-files/owned-files'
 import { OWNED_FILE_CONTEXTS } from '@/lib/workspace-files/owned-files'
 import {
   isResolvedSecretProvenanceAbsence,
@@ -79,7 +80,8 @@ interface WorkspaceFileAttachmentIdentity {
 export interface WorkspaceFileSecretProvenanceIdentity {
   fileId: string
   key: string
-  context: 'workspace' | 'mothership' | 'execution'
+  /** The row's `context`: a store, or the owner of an owned file (a test or release body). */
+  context: 'workspace' | 'mothership' | 'execution' | OwnedFileContext
   contentUpdatedAt?: Date
 }
 
@@ -857,20 +859,75 @@ export async function markWorkspaceFileSecretProvenanceUnknown(
   })
 }
 
+interface BoundWorkspaceFileProvenanceRow {
+  key: string
+  context: string
+  fileContentUpdatedAt: Date
+  secretProvenanceVersion: number | null
+  provenanceContentUpdatedAt: Date | null
+  status: string | null
+  entries: unknown
+}
+
+/**
+ * Saving a chat upload changes its context but preserves its id, key, and bytes. Only a reader
+ * that captured the content revision may follow that promotion; the revision check still refuses an
+ * intervening content write, including on a legacy untracked file.
+ */
+function acceptsIdentityContext(identity: WorkspaceFileSecretProvenanceIdentity, context: string) {
+  return identity.context === 'mothership' && identity.contentUpdatedAt
+    ? context === 'mothership' || context === 'workspace'
+    : context === identity.context
+}
+
+/** Classifies one stored row for the exact identity a reader captured, failing closed on drift. */
+function bindWorkspaceFileSecretProvenance(
+  identity: WorkspaceFileSecretProvenanceIdentity,
+  row: BoundWorkspaceFileProvenanceRow | undefined
+): WorkspaceFileSecretProvenance {
+  if (!row || row.key !== identity.key || !acceptsIdentityContext(identity, row.context)) {
+    return { status: 'unknown' }
+  }
+  /**
+   * A version mismatch is not an absence: the caller is asking about content this file no longer
+   * holds, so nothing can be said about it and no policy relaxes that.
+   */
+  if (
+    identity.contentUpdatedAt &&
+    identity.contentUpdatedAt.getTime() !== row.fileContentUpdatedAt.getTime()
+  ) {
+    return { status: 'unknown' }
+  }
+  if (row.secretProvenanceVersion === null) return EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
+  if (row.secretProvenanceVersion !== 1) return { status: 'unknown' }
+  const bindingIsCurrent =
+    row.provenanceContentUpdatedAt?.getTime() === row.fileContentUpdatedAt.getTime()
+  if (!bindingIsCurrent || !isValidStoredEntries(row.entries, row.status))
+    return { status: 'unknown' }
+  /**
+   * Preserve absence separately from protection failures so consumers apply the matching policy.
+   */
+  if (row.status === 'unrecorded') return { status: 'unrecorded' }
+  if (row.status !== 'exact') return { status: 'unknown' }
+  return { status: 'exact', entries: deserializeExactEntriesFromStorage(row.entries) }
+}
+
+const boundProvenanceColumns = {
+  id: workspaceFiles.id,
+  key: workspaceFiles.key,
+  context: workspaceFiles.context,
+  fileContentUpdatedAt: workspaceFiles.contentUpdatedAt,
+  secretProvenanceVersion: workspaceFiles.secretProvenanceVersion,
+  provenanceContentUpdatedAt: workspaceFileSecretProvenance.contentUpdatedAt,
+  status: workspaceFileSecretProvenance.status,
+  entries: workspaceFileSecretProvenance.entries,
+}
+
 /** Reads provenance only when it still belongs to this exact canonical file id and storage key. */
 export async function getBoundWorkspaceFileSecretProvenance(
   workspaceId: string,
   identity: WorkspaceFileSecretProvenanceIdentity
 ): Promise<WorkspaceFileSecretProvenance> {
-  /**
-   * Saving a chat upload changes its context but preserves its id, key, and bytes. Only a reader
-   * that captured the content revision may follow that promotion; the revision check below still
-   * refuses an intervening content write, including on a legacy untracked file.
-   */
-  const contextCondition =
-    identity.context === 'mothership' && identity.contentUpdatedAt
-      ? inArray(workspaceFiles.context, ['mothership', 'workspace'])
-      : eq(workspaceFiles.context, identity.context)
   const [row] = await db
     .select({
       fileContentUpdatedAt: workspaceFiles.contentUpdatedAt,
@@ -889,37 +946,140 @@ export async function getBoundWorkspaceFileSecretProvenance(
         eq(workspaceFiles.id, identity.fileId),
         eq(workspaceFiles.key, identity.key),
         eq(workspaceFiles.workspaceId, workspaceId),
-        contextCondition
+        identity.context === 'mothership' && identity.contentUpdatedAt
+          ? inArray(workspaceFiles.context, ['mothership', 'workspace'])
+          : eq(workspaceFiles.context, identity.context)
         // Deliberately no deletedAt filter: `id` alone pins the exact row, and
         // recently-deleted/ reads are a real surface — excluding soft-deleted
         // rows made every archived file read as provenance-unknown and refused.
       )
     )
     .limit(1)
+  return bindWorkspaceFileSecretProvenance(
+    identity,
+    row && { ...row, key: identity.key, context: identity.context }
+  )
+}
 
-  if (!row) return { status: 'unknown' }
-  /**
-   * A version mismatch is not an absence: the caller is asking about content this file no longer
-   * holds, so nothing can be said about it and no policy relaxes that.
-   */
-  if (
-    identity.contentUpdatedAt &&
-    identity.contentUpdatedAt.getTime() !== row.fileContentUpdatedAt.getTime()
-  ) {
-    return { status: 'unknown' }
+/**
+ * Classifies many files a reader already resolved, one statement per thousand ids, with exactly the
+ * per-file binding of {@link getBoundWorkspaceFileSecretProvenance}: key and context are compared
+ * on the fetched row rather than in the query. Every requested id is answered.
+ */
+export async function getBoundWorkspaceFileSecretProvenanceByIdentity(
+  workspaceId: string,
+  identities: readonly WorkspaceFileSecretProvenanceIdentity[]
+): Promise<Map<string, WorkspaceFileSecretProvenance>> {
+  const rowsById = new Map<string, BoundWorkspaceFileProvenanceRow>()
+  const ids = [...new Set(identities.map((identity) => identity.fileId))]
+  for (let index = 0; index < ids.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    const rows = await db
+      .select(boundProvenanceColumns)
+      .from(workspaceFiles)
+      .leftJoin(
+        workspaceFileSecretProvenance,
+        eq(workspaceFileSecretProvenance.fileId, workspaceFiles.id)
+      )
+      .where(
+        and(
+          inArray(workspaceFiles.id, ids.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)),
+          /** As the single read: no deletedAt filter, so archived files keep their class. */
+          eq(workspaceFiles.workspaceId, workspaceId)
+        )
+      )
+    for (const row of rows) rowsById.set(row.id, row)
   }
-  if (row.secretProvenanceVersion === null) return EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
-  if (row.secretProvenanceVersion !== 1) return { status: 'unknown' }
-  const bindingIsCurrent =
-    row.provenanceContentUpdatedAt?.getTime() === row.fileContentUpdatedAt.getTime()
-  if (!bindingIsCurrent || !isValidStoredEntries(row.entries, row.status))
-    return { status: 'unknown' }
-  /**
-   * Preserve absence separately from protection failures so consumers apply the matching policy.
-   */
-  if (row.status === 'unrecorded') return { status: 'unrecorded' }
-  if (row.status !== 'exact') return { status: 'unknown' }
-  return { status: 'exact', entries: deserializeExactEntriesFromStorage(row.entries) }
+  const result = new Map<string, WorkspaceFileSecretProvenance>()
+  for (const identity of identities) {
+    if (result.get(identity.fileId)?.status === 'unknown') continue
+    result.set(
+      identity.fileId,
+      bindWorkspaceFileSecretProvenance(identity, rowsById.get(identity.fileId))
+    )
+  }
+  return result
+}
+
+/**
+ * Classifies the bytes each file holds now, for a surface that serves whatever is current (a share
+ * link). Ids outside the workspace, or gone, read as unknown.
+ */
+export async function getCurrentWorkspaceFileSecretProvenance(
+  workspaceId: string,
+  fileIds: readonly string[]
+): Promise<Map<string, WorkspaceFileSecretProvenance>> {
+  const result = new Map<string, WorkspaceFileSecretProvenance>()
+  const ids = [...new Set(fileIds)]
+  for (let index = 0; index < ids.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    const rows = await db
+      .select(boundProvenanceColumns)
+      .from(workspaceFiles)
+      .leftJoin(
+        workspaceFileSecretProvenance,
+        eq(workspaceFileSecretProvenance.fileId, workspaceFiles.id)
+      )
+      .where(
+        and(
+          inArray(workspaceFiles.id, ids.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)),
+          eq(workspaceFiles.workspaceId, workspaceId)
+        )
+      )
+    for (const row of rows) {
+      const context =
+        row.context === 'mothership' || row.context === 'execution' ? row.context : 'workspace'
+      result.set(
+        row.id,
+        bindWorkspaceFileSecretProvenance(
+          { fileId: row.id, key: row.key, context, contentUpdatedAt: row.fileContentUpdatedAt },
+          row
+        )
+      )
+    }
+  }
+  for (const id of ids) if (!result.has(id)) result.set(id, { status: 'unknown' })
+  return result
+}
+
+/**
+ * Classifies stored objects by key, for a reader that addresses bytes by the key a recording names
+ * (a run's output file) rather than by a canonical file id. The newest active row for a key wins,
+ * then its newest archived execution row. A key a superseded version still names is `unknown`. A
+ * key with no row at all is storage no file names (a direct upload, or legacy storage that
+ * predates metadata rows) and maps to `undefined`, which each caller treats as its surface does.
+ */
+export async function getStoredFileSecretProvenanceByKey(
+  workspaceId: string,
+  keys: readonly string[]
+): Promise<Map<string, WorkspaceFileSecretProvenance | undefined>> {
+  const uniqueKeys = [...new Set(keys.filter((key) => key.length > 0))]
+  const rows = await loadModelSafeWorkspaceFileRows(uniqueKeys)
+  const rowByKey = new Map(rows.map((row) => [row.key, row]))
+  const versionKeys = await findWorkspaceFileVersionKeys(
+    uniqueKeys.filter((key) => !rowByKey.has(key))
+  )
+  return new Map(
+    uniqueKeys.map((key): [string, WorkspaceFileSecretProvenance | undefined] => {
+      const row = rowByKey.get(key)
+      if (!row) return [key, versionKeys.has(key) ? { status: 'unknown' } : undefined]
+      if (row.workspaceId !== workspaceId) return [key, { status: 'unknown' }]
+      /** Other stores keep their own provenance, as the attachment filter has always treated them. */
+      if (
+        row.context !== 'workspace' &&
+        row.context !== 'mothership' &&
+        row.context !== 'execution'
+      ) {
+        return [key, { status: 'unrecorded' }]
+      }
+      const context = row.context
+      return [
+        key,
+        bindWorkspaceFileSecretProvenance(
+          { fileId: key, key, context, contentUpdatedAt: row.fileContentUpdatedAt },
+          row
+        ),
+      ]
+    })
+  )
 }
 
 /** Batch-loads classifications already bound to exact, authorized file metadata snapshots. */
@@ -1129,7 +1289,7 @@ export async function importWorkspaceFileSecretProvenanceForRuntime(args: {
 }
 
 /** Imports a classification already bound by an authorized read to its returned byte snapshot. */
-export async function importWorkspaceFileSnapshotProvenance(args: {
+async function importWorkspaceFileSnapshotProvenance(args: {
   workspaceId: string
   provenance: WorkspaceFileSecretProvenance
   resourceId?: string
@@ -1176,9 +1336,6 @@ export async function filterModelSafeWorkspaceFileAttachments<
   options: { workspaceId?: string } = {}
 ): Promise<TAttachment[]> {
   if (attachments.length === 0) return []
-  if (attachments.length > PROVENANCE_MAX_ENTRIES) {
-    throw new Error('Too many file attachments to verify secret provenance')
-  }
 
   const keys = [
     ...new Set(
@@ -1245,8 +1402,23 @@ function classifyModelSafeWorkspaceFileRow(
   return row.entries.length === 0 ? 'safe' : 'unsafe'
 }
 
+/** Ids per statement bound a query, never how many keys a caller may classify. */
 async function loadModelSafeWorkspaceFileRows(
   keys: readonly string[]
+): Promise<ModelSafeWorkspaceFileRow[]> {
+  const rows: ModelSafeWorkspaceFileRow[] = []
+  for (let index = 0; index < keys.length; index += FILE_PROVENANCE_QUERY_CHUNK_SIZE) {
+    rows.push(
+      ...(await loadModelSafeWorkspaceFileRowChunk(
+        keys.slice(index, index + FILE_PROVENANCE_QUERY_CHUNK_SIZE)
+      ))
+    )
+  }
+  return rows
+}
+
+async function loadModelSafeWorkspaceFileRowChunk(
+  keys: readonly string[]
 ): Promise<ModelSafeWorkspaceFileRow[]> {
   return db
     .selectDistinctOn([workspaceFiles.key], {
@@ -1302,9 +1474,6 @@ export async function areModelSafeWorkspaceFileKeys(
 ): Promise<boolean> {
   const uniqueKeys = [...new Set(keys.filter((key) => key.length > 0))]
   if (uniqueKeys.length === 0) return true
-  if (uniqueKeys.length > PROVENANCE_MAX_ENTRIES) {
-    throw new Error('Too many file keys to verify secret provenance')
-  }
 
   const rows = await loadModelSafeWorkspaceFileRows(uniqueKeys)
   const rowKeys = new Set(rows.map((row) => row.key))
diff --git a/apps/sim/lib/workflow-tests/application/availability.ts b/apps/sim/lib/workflow-tests/application/availability.ts
index 26d9381bd50..87e2145de0d 100644
--- a/apps/sim/lib/workflow-tests/application/availability.ts
+++ b/apps/sim/lib/workflow-tests/application/availability.ts
@@ -9,6 +9,7 @@ const availabilityOperation = defineWorkspaceOperation({
   oauthScope: 'api:read',
   workspaceApiKey: 'allow',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: [
     'session',
     'personal_api_key',
diff --git a/apps/sim/lib/workflow-tests/application/operations.ts b/apps/sim/lib/workflow-tests/application/operations.ts
index 09ffaf3ef0c..8b69124cc11 100644
--- a/apps/sim/lib/workflow-tests/application/operations.ts
+++ b/apps/sim/lib/workflow-tests/application/operations.ts
@@ -13,6 +13,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:read',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.read',
     minimumRole: 'read',
   }),
@@ -20,6 +21,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.create',
     minimumRole: 'write',
   }),
@@ -27,6 +29,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.update',
     minimumRole: 'write',
   }),
@@ -34,6 +37,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.run',
     minimumRole: 'write',
   }),
@@ -41,6 +45,7 @@ export const workflowTestOperations = {
     ...policy,
     oauthScope: 'api:write',
     capability: 'files.use',
+    contentDelivery: 'none',
     id: 'workflow_tests.delete',
     minimumRole: 'write',
   }),
diff --git a/apps/sim/lib/workflows/application/admit-run-files.test.ts b/apps/sim/lib/workflows/application/admit-run-files.test.ts
new file mode 100644
index 00000000000..4c6eec1e5e2
--- /dev/null
+++ b/apps/sim/lib/workflows/application/admit-run-files.test.ts
@@ -0,0 +1,226 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  createDelegatedPrincipal,
+  createExecutorPrincipal,
+} from '@sim/testing/factories/principal.factory'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+const provenance = {
+  getStoredFileSecretProvenanceByKey:
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey,
+}
+
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application'
+import {
+  admitRunFiles,
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
+import type { UserFile } from '@/executor/types'
+
+const now = Date.now()
+const CHAT = createDelegatedPrincipal()
+const EXECUTOR = createExecutorPrincipal()
+
+const ENTRY = { encryptedValue: 'ciphertext', sourceUserId: 'user-1' }
+
+/** Stored classification per run file key; a key absent from the map has no metadata row. */
+const STORED = new Map<string, unknown>([
+  ['key-clean', { status: 'exact', entries: [] }],
+  ['key-secret', { status: 'exact', entries: [ENTRY] }],
+  ['key-superseded', { status: 'unknown' }],
+  ['key-untracked', undefined],
+])
+
+/** Refuses unknown items and opaque views of items holding secrets, as Chat's registry gate does. */
+const GATE: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance: item, view }) =>
+        item.status !== 'unknown' &&
+        !(item.status === 'exact' && item.entries.length > 0 && view === 'opaque')
+    )
+  },
+}
+
+function runFile(name: string, extra: Partial<UserFile> = {}): UserFile {
+  return {
+    id: `file-${name}`,
+    name: `${name}.txt`,
+    url: `https://files.invalid/${name}`,
+    size: 4,
+    type: 'text/plain',
+    key: `key-${name}`,
+    ...extra,
+  }
+}
+
+beforeEach(() => {
+  provenance.getStoredFileSecretProvenanceByKey.mockImplementation(
+    async (_workspaceId: string, keys: readonly string[]) =>
+      new Map(keys.filter((key) => STORED.has(key)).map((key) => [key, STORED.get(key)]))
+  )
+})
+
+describe('admitRunFiles', () => {
+  it('classifies each run file by the key the run recorded', async () => {
+    const files = ['clean', 'secret', 'superseded', 'untracked', 'unnamed'].map((name) =>
+      runFile(name)
+    )
+    const admitted = await observeContentDelivery(GATE, () =>
+      admitRunFiles(CHAT, 'workspace-1', files, 'opaque')
+    )
+    /**
+     * A key with no metadata row predates them (unrecorded, admitted); a key no lookup answered,
+     * or a superseded version, is unknown; secrets in an opaque view are refused.
+     */
+    expect([...admitted].sort()).toEqual(['file-clean', 'file-untracked'])
+  })
+
+  it('admits a secret-bearing file when the view is text egress can redact', async () => {
+    const admitted = await observeContentDelivery(GATE, () =>
+      admitRunFiles(CHAT, 'workspace-1', [runFile('secret')], 'complete')
+    )
+    expect([...admitted]).toEqual(['file-secret'])
+  })
+
+  it('admits every file for a caller no gate observes, without reading provenance', async () => {
+    const files = [runFile('superseded'), runFile('secret')]
+    const admitted = await admitRunFiles(EXECUTOR, 'workspace-1', files, 'opaque')
+    expect([...admitted].sort()).toEqual(['file-secret', 'file-superseded'])
+    expect(provenance.getStoredFileSecretProvenanceByKey).not.toHaveBeenCalled()
+  })
+})
+
+describe('withholdUnadmittedInlineFiles', () => {
+  it.each(['clean', 'secret'])(
+    'handles deeply nested %s files without a call-stack limit',
+    async (kind) => {
+      let output: unknown = runFile(kind, { base64: 'Ynl0ZXM=' })
+      for (let depth = 0; depth < 12_000; depth++) output = [output]
+      const result = await observeContentDelivery(GATE, () =>
+        withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+      )
+      let leaf = result
+      while (Array.isArray(leaf)) leaf = leaf[0]
+      expect(leaf).toMatchObject({ id: `file-${kind}` })
+      if (kind === 'secret') expect(leaf).not.toHaveProperty('base64')
+      else expect(result).toBe(output)
+    }
+  )
+
+  it('strips base64 only from files Chat may not receive, keeping their descriptors', async () => {
+    const clean = runFile('clean', { base64: 'Y2xlYW4=' })
+    const secret = runFile('secret', { base64: 'c2VjcmV0' })
+    const output = {
+      result: { files: [clean, secret], note: 'done' },
+      count: 2,
+      at: new Date(now),
+    }
+    const withheld = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    const { base64: _secretBytes, ...secretDescriptor } = secret
+    expect(withheld).toEqual({
+      result: { files: [clean, secretDescriptor], note: 'done' },
+      count: 2,
+      at: output.at,
+    })
+    expect(withheld.at).toBe(output.at)
+    expect(output.result.files[1].base64).toBe('c2VjcmV0')
+  })
+
+  it('returns the very same value when every inlined file is admitted', async () => {
+    const output = { files: [runFile('clean', { base64: 'Y2xlYW4=' }), runFile('secret')] }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result).toBe(output)
+  })
+
+  it('withholds a file reached through shared references everywhere it appears', async () => {
+    const secret = runFile('secret', { base64: 'c2VjcmV0' })
+    const shared = { file: secret }
+    const output = { first: shared, second: shared, list: [secret] }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result.first).toBe(result.second)
+    expect(result.first.file).not.toHaveProperty('base64')
+    expect(result.list[0]).not.toHaveProperty('base64')
+  })
+
+  it('terminates on a cyclic output and withholds the file inside it', async () => {
+    const node: { file: UserFile; self?: unknown } = {
+      file: runFile('secret', { base64: 'c2VjcmV0' }),
+    }
+    node.self = node
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', { node })
+    )
+    expect(result.node.file).not.toHaveProperty('base64')
+  })
+
+  it('withholds inline bytes even after a byteless descriptor of the same file', async () => {
+    const output = {
+      first: runFile('secret'),
+      later: runFile('secret', { base64: 'c2VjcmV0' }),
+    }
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(result.later).not.toHaveProperty('base64')
+  })
+
+  it('keeps an own `__proto__` key as data in the copy', async () => {
+    const output = JSON.parse('{"__proto__":{"note":"kept"},"files":[]}')
+    output.files.push(runFile('secret', { base64: 'c2VjcmV0' }))
+    const result = await observeContentDelivery(GATE, () =>
+      withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output)
+    )
+    expect(Object.getPrototypeOf(result)).toBe(Object.prototype)
+    expect(Object.hasOwn(result, '__proto__')).toBe(true)
+    expect(result.files[0]).not.toHaveProperty('base64')
+  })
+
+  it('refuses refused bytes held by an object it cannot rebuild', async () => {
+    class Envelope {
+      constructor(readonly file: UserFile) {}
+    }
+    const output = { wrapped: new Envelope(runFile('secret', { base64: 'c2VjcmV0' })) }
+    await expect(
+      observeContentDelivery(GATE, () => withholdUnadmittedInlineFiles(CHAT, 'workspace-1', output))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('leaves every caller no gate observes byte-identical', async () => {
+    const output = { files: [runFile('superseded', { base64: 'b2xk' })] }
+    expect(await withholdUnadmittedInlineFiles(EXECUTOR, 'workspace-1', output)).toBe(output)
+  })
+})
+
+describe('inlinesRunFiles', () => {
+  it('disables inline bytes for Chat only on a run that streams its result', () => {
+    observeContentDelivery(GATE, () => {
+      expect(inlinesRunFiles(CHAT, true, 'stream')).toBe(false)
+      expect(inlinesRunFiles(CHAT, true, undefined)).toBe(false)
+      expect(inlinesRunFiles(CHAT, true, 'sync')).toBe(true)
+      expect(inlinesRunFiles(CHAT, undefined, 'stream')).toBe(false)
+    })
+    expect(inlinesRunFiles(EXECUTOR, true, 'stream')).toBe(true)
+  })
+})
diff --git a/apps/sim/lib/workflows/application/admit-run-files.ts b/apps/sim/lib/workflows/application/admit-run-files.ts
new file mode 100644
index 00000000000..717cd3ef7cd
--- /dev/null
+++ b/apps/sim/lib/workflows/application/admit-run-files.ts
@@ -0,0 +1,171 @@
+import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  admitEach,
+  ContentRefusedError,
+  type ContentView,
+  isCopilotPrincipal,
+} from '@/lib/core/application'
+import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
+import { getStoredFileSecretProvenanceByKey } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { UserFile } from '@/executor/types'
+
+/** Admits each run file on its own; see {@link admitRunFiles}. Returns the admitted files. */
+async function admitRunFileItems(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly UserFile[],
+  view: ContentView
+): Promise<UserFile[]> {
+  return admitEach(principal, files, async (items) => {
+    const provenance = await getStoredFileSecretProvenanceByKey(
+      workspaceId,
+      items.map((file) => file.key)
+    )
+    return items.map((file) => ({
+      kind: 'execution-file' as const,
+      id: file.id,
+      /** A run file no metadata row names predates them: an absence, audited, not taint. */
+      provenance: provenance.has(file.key)
+        ? (provenance.get(file.key) ?? { status: 'unrecorded' as const })
+        : { status: 'unknown' as const },
+      view,
+    }))
+  })
+}
+
+/**
+ * Admits each file a run produced on its own, classified by the storage key the run recorded, and
+ * returns the ids admitted. A caller no gate observes gets every id back without a provenance read.
+ */
+export async function admitRunFiles(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly UserFile[],
+  view: ContentView
+): Promise<Set<string>> {
+  const admitted = await admitRunFileItems(principal, workspaceId, files, view)
+  return new Set(admitted.map((file) => file.id))
+}
+
+/**
+ * Every file descriptor in an output that inlines bytes, once per storage key. Not deduplicated by
+ * id: an earlier descriptor of the same file without bytes must not hide a later one with them.
+ */
+function collectInlinedFiles(value: unknown, files: Map<string, UserFile>, seen: WeakSet<object>) {
+  const pending: Iterator<unknown>[] = [[value].values()]
+  while (pending.length > 0) {
+    const iterator = pending[pending.length - 1]
+    const next = iterator.next()
+    if (next.done) {
+      pending.pop()
+      continue
+    }
+    const current = next.value
+    if (!current || typeof current !== 'object' || seen.has(current)) continue
+    seen.add(current)
+    if (isUserFileWithMetadata(current)) {
+      if (typeof current.base64 === 'string' && !files.has(current.key)) {
+        files.set(current.key, current)
+      }
+      continue
+    }
+    pending.push((Array.isArray(current) ? current : Object.values(current)).values())
+  }
+}
+
+function withoutUnadmittedBase64(value: unknown, admittedKeys: ReadonlySet<string>): unknown {
+  const seen = new WeakMap<object, unknown>()
+  const pending: {
+    target: object
+    entries: Iterator<[string | number, unknown]>
+  }[] = []
+  const copy = (current: unknown): unknown => {
+    if (!current || typeof current !== 'object') return current
+    const copied = seen.get(current)
+    if (copied !== undefined) return copied
+    if (isUserFileWithMetadata(current)) {
+      if (typeof current.base64 !== 'string' || admittedKeys.has(current.key)) return current
+      const { base64: _withheld, ...described } = current
+      seen.set(current, described)
+      return described
+    }
+    /** Register the copy before scheduling its children so shared and cyclic references agree. */
+    if (Array.isArray(current)) {
+      const items: unknown[] = []
+      seen.set(current, items)
+      pending.push({ target: items, entries: current.entries() })
+      return items
+    }
+    /** Non-data objects keep their identity; refused bytes inside one cannot be removed safely. */
+    const prototype = Object.getPrototypeOf(current)
+    if (prototype !== Object.prototype && prototype !== null) {
+      const held = new Map<string, UserFile>()
+      collectInlinedFiles(current, held, new WeakSet())
+      for (const file of held.values()) {
+        if (!admittedKeys.has(file.key)) throw new ContentRefusedError('execution-file')
+      }
+      return current
+    }
+    const record: Record<string, unknown> = prototype === null ? Object.create(null) : {}
+    seen.set(current, record)
+    pending.push({ target: record, entries: Object.entries(current).values() })
+    return record
+  }
+  const result = copy(value)
+  while (pending.length > 0) {
+    const frame = pending[pending.length - 1]
+    const next = frame.entries.next()
+    if (next.done) {
+      pending.pop()
+      continue
+    }
+    const [key, item] = next.value
+    /** An own `__proto__` key remains data rather than replacing the copied object's prototype. */
+    Object.defineProperty(frame.target, key, {
+      value: copy(item),
+      enumerable: true,
+      writable: true,
+      configurable: true,
+    })
+  }
+  return result
+}
+
+/**
+ * Keeps an output's inlined file bytes only for files admitted on their own; another file keeps
+ * its descriptor without `base64`, and stays downloadable through the run's file route, which is
+ * gated per file. Inlined base64 is opaque to text redaction.
+ */
+export async function withholdUnadmittedInlineFiles<T>(
+  principal: Principal,
+  workspaceId: string,
+  value: T
+): Promise<T> {
+  /** Only Chat is classified; every other caller keeps its output unwalked. */
+  if (!isCopilotPrincipal(principal)) {
+    await admitContent(principal, [])
+    return value
+  }
+  const found = new Map<string, UserFile>()
+  collectInlinedFiles(value, found, new WeakSet())
+  const inlined = [...found.values()]
+  const admitted = await admitRunFileItems(principal, workspaceId, inlined, 'opaque')
+  if (admitted.length === inlined.length) return value
+  const admittedKeys = new Set(admitted.map((file) => file.key))
+  return withoutUnadmittedBase64(value, admittedKeys) as T
+}
+
+/**
+ * Inline base64 a streamed run emits cannot be withheld per file once it is on the wire, so Chat
+ * receives inline file bytes only from a run that returns its whole result at once; every file
+ * stays downloadable through the run's file route, gated per file.
+ */
+export function inlinesRunFiles(
+  principal: Principal,
+  requested: boolean | undefined,
+  mode: string | undefined
+): boolean | undefined {
+  /** An omitted flag inlines by default downstream, so Chat's streamed runs pin it off. */
+  return mode !== 'sync' && isCopilotPrincipal(principal) ? false : requested
+}
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
index c81b3be8350..55c5485aea3 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.test.ts
@@ -10,11 +10,19 @@ import {
   workflowContextMockFns,
 } from '@sim/testing/mocks/workflow-context.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   getRunFiles: vi.fn(),
 }))
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
@@ -27,8 +35,31 @@ vi.mock('@/lib/workflows/executor/execution-run-files', () => ({
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
 import { Readable } from 'node:stream'
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  isCopilotPrincipal,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { downloadWorkflowRunFileStream } from '@/lib/workflows/application/download-workflow-run-file'
 
+/** Chat's gate with no registry: it admits only a file with no recorded secret. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+
+/** Runs as each surface does: Chat under its gate, every other caller unobserved. */
+function download(principal: Principal, args = input()) {
+  const execute = () => downloadWorkflowRunFileStream.execute({ principal, input: args })
+  return isCopilotPrincipal(principal) ? observeContentDelivery(secretFreeGate, execute) : execute()
+}
+
 const mockDownloadFileStream = storageServiceMockFns.mockDownloadFileStream
 
 const mockResolvePermission = workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission
@@ -98,16 +129,50 @@ describe('downloadWorkflowRunFileStream', () => {
     )
     mocks.getRunFiles.mockResolvedValue(terminalRun())
     mockDownloadFileStream.mockResolvedValue(Readable.from([Buffer.from('pdf')]))
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, { status: 'exact', entries: [] }]])
+    )
   })
 
   it.each(principals)('allows $kind at the read role', async (principal) => {
-    const result = await downloadWorkflowRunFileStream.execute({ principal, input: input() })
+    const result = await download(principal)
 
     expect(result.file.id).toBe(FILE_ID)
     expect(result.contentType).toBe('application/pdf')
     expect(result.contentLength).toBe(3)
   })
 
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }] },
+  ])('refuses Chat a run file its gate refuses, before opening it: %j', async (provenance) => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, provenance]])
+    )
+    await expect(download(principals[3])).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey
+    ).toHaveBeenCalledWith('workspace-1', [FILE_KEY])
+    expect(mockDownloadFileStream).not.toHaveBeenCalled()
+  })
+
+  it('classifies storage no metadata row names as unrecorded, admitting it', async () => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, undefined]])
+    )
+    expect((await download(principals[3])).file.id).toBe(FILE_ID)
+  })
+
+  it('serves a caller outside Chat without classifying', async () => {
+    workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey.mockResolvedValue(
+      new Map([[FILE_KEY, { status: 'unknown' }]])
+    )
+    expect((await download(principals[0])).file.id).toBe(FILE_ID)
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetStoredFileSecretProvenanceByKey
+    ).not.toHaveBeenCalled()
+  })
+
   /**
    * `HEAD` on this route runs the authorization phase alone. With the file
    * lookup downstream of it, `authorize` succeeded for any id at all, so a
diff --git a/apps/sim/lib/workflows/application/download-workflow-run-file.ts b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
index d8bbac08b4b..de65b6721fd 100644
--- a/apps/sim/lib/workflows/application/download-workflow-run-file.ts
+++ b/apps/sim/lib/workflows/application/download-workflow-run-file.ts
@@ -1,9 +1,11 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { ContentRefusedError } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { nodeReadableToWebStream } from '@/lib/core/utils/node-stream'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { inferContextFromKey } from '@/lib/uploads/utils/file-utils'
+import { admitRunFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import {
   type ActiveWorkflowRunApplicationContext,
@@ -91,12 +93,15 @@ async function resolveDownloadWorkflowRunFileContext(
 
 async function executeDownloadWorkflowRunFile({
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof workflowOperations.downloadRunFile,
   DownloadWorkflowRunFileInput,
   DownloadWorkflowRunFileContext
 >): Promise<DownloadWorkflowRunFileResult> {
   const { file } = context
+  const admitted = await admitRunFiles(principal, context.workspaceId, [file], 'complete')
+  if (!admitted.has(file.id)) throw new ContentRefusedError('execution-file')
 
   /**
    * The storage context is inferred from the key rather than read off the
diff --git a/apps/sim/lib/workflows/application/execute-manual-workflow.ts b/apps/sim/lib/workflows/application/execute-manual-workflow.ts
index d949bea2f5b..5f51a6a5939 100644
--- a/apps/sim/lib/workflows/application/execute-manual-workflow.ts
+++ b/apps/sim/lib/workflows/application/execute-manual-workflow.ts
@@ -1,6 +1,10 @@
 import { requirePrincipalSubjectUserId, type WorkflowExecutionPrincipal } from '@sim/auth/principal'
 import { mergeSubblockStateWithValues } from '@sim/workflow-persistence/subblocks'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import {
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
 import type { ExecuteWorkflowInput } from '@/lib/workflows/application/execute-workflow'
@@ -133,7 +137,11 @@ function executionServiceInput(params: {
     callChain: params.input.callChain,
     useAuthenticatedUserAsActor: true,
     workflowRecord: params.context.workflow,
-    includeFileBase64: params.input.includeFileBase64,
+    includeFileBase64: inlinesRunFiles(
+      params.principal,
+      params.input.includeFileBase64,
+      params.input.mode
+    ),
     base64MaxBytes: params.input.base64MaxBytes,
     selectedOutputs: params.input.selectedOutputs,
     stopAfterBlockId: params.input.stopAfterBlockId,
@@ -193,11 +201,12 @@ export const executeManualWorkflowOperation = defineAuthorizedWorkflowUseCase({
       throw new OrchestrationError('validation', validation.error)
     }
 
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       ...executionServiceInput({ principal, context, input, draftState: state }),
       input: executionInput,
       triggerBlockId: selected.triggerBlockId,
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
 
@@ -222,7 +231,7 @@ export const executeManualWorkflowFromBlockOperation = defineAuthorizedWorkflowU
       )
     }
 
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       ...executionServiceInput({ principal, context, input, draftState: state }),
       input: input.input,
       runFromBlock: {
@@ -231,5 +240,6 @@ export const executeManualWorkflowFromBlockOperation = defineAuthorizedWorkflowU
         sourceExecutionId: input.sourceRunId,
       },
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/application/execute-workflow.ts b/apps/sim/lib/workflows/application/execute-workflow.ts
index d7c8f74aed4..5f50a2d665d 100644
--- a/apps/sim/lib/workflows/application/execute-workflow.ts
+++ b/apps/sim/lib/workflows/application/execute-workflow.ts
@@ -1,5 +1,9 @@
 import type { Principal } from '@sim/auth/principal'
 import { resolvePrincipalAttribution } from '@sim/auth/principal'
+import {
+  inlinesRunFiles,
+  withholdUnadmittedInlineFiles,
+} from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -41,7 +45,7 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
     const attribution = resolvePrincipalAttribution(principal, {
       workspaceBillingOwnerUserId: context.billedAccountUserId,
     })
-    return executeWorkflowService({
+    const result = await executeWorkflowService({
       workflowId: context.workflowId,
       principal,
       userId: attribution.attributedUserId,
@@ -52,7 +56,7 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
       callChain: input.callChain,
       useAuthenticatedUserAsActor: authenticatesExecutionCredentials(principal),
       workflowRecord: context.workflow,
-      includeFileBase64: input.includeFileBase64,
+      includeFileBase64: inlinesRunFiles(principal, input.includeFileBase64, input.mode),
       base64MaxBytes: input.base64MaxBytes,
       selectedOutputs: input.selectedOutputs,
       rateLimitCounter: input.mode === 'async' ? 'async' : 'sync',
@@ -63,5 +67,6 @@ export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
       includeThinking: input.includeThinking,
       includeToolCalls: input.includeToolCalls,
     })
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/application/operations.ts b/apps/sim/lib/workflows/application/operations.ts
index 2ac6852a2bd..dec0ed036fd 100644
--- a/apps/sim/lib/workflows/application/operations.ts
+++ b/apps/sim/lib/workflows/application/operations.ts
@@ -45,6 +45,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: reading a workflow is governed by workspace role, not by a group capability
@@ -54,6 +55,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   /** Full diagnostics retain the caller's subject for protected reference and secret reads. */
@@ -64,6 +66,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -73,6 +76,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: inspecting saved tool bindings reads workflow content; protected dependencies reauthorize separately
@@ -81,6 +85,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow module has no hide key, so creating a workflow is governed by workspace role alone
@@ -90,6 +95,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: renaming or re-describing a workflow is governed by workspace role
@@ -99,6 +105,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -123,6 +130,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -150,6 +158,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: restoring a soft-deleted workflow is governed by workspace role
@@ -159,6 +168,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a workflow's run policy is workspace-admin configuration; no group capability withholds it
@@ -176,6 +186,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: moving workflows between folders is placement, governed by workspace role
@@ -185,6 +196,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: duplicating copies a graph the caller may already read into the same workspace, so it crosses no capability boundary
@@ -194,6 +206,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -202,6 +215,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -211,6 +225,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -219,6 +234,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a single block is governed by workspace role; Chat itself is withheld by copilot.use at the chat surface
@@ -227,6 +243,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...COPILOT_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: deleting a workflow is governed by workspace role
@@ -236,6 +253,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; reading it is governed by workspace role
@@ -245,6 +263,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -254,6 +273,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -263,6 +283,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: the workflow folder tree has no hide key; arranging it is governed by workspace role
@@ -272,6 +293,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   deploy: defineWorkspaceOperation({
@@ -280,6 +302,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   undeploy: defineWorkspaceOperation({
@@ -288,6 +311,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   deployChat: defineWorkspaceOperation({
@@ -296,6 +320,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.chat',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -313,6 +338,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -322,6 +348,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'deploy.api',
+    contentDelivery: 'none',
     ...WORKFLOW_DEPLOYMENT_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: reverting the draft to an earlier version edits workflow content; deployment capabilities govern what is served, not what is edited
@@ -331,6 +358,7 @@ export const workflowOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     ...HUMAN_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a version's name and description are metadata on workflow content, governed by workspace role
@@ -340,6 +368,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: comparing deployment versions reads workflow content, governed by workspace role
@@ -349,6 +378,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: version history is workflow content, governed by workspace role
@@ -358,6 +388,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: version history is workflow content, governed by workspace role
@@ -367,6 +398,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...WORKFLOW_READ_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: an export returns the graph its reader can already open; logs.export withholds execution logs, not definitions
@@ -376,6 +408,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -387,6 +420,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: importing is workflow authoring governed by workspace role; the blocks the payload carries are judged against allowedIntegrations before they are persisted
@@ -396,6 +430,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: running a workflow from an authenticated surface is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
@@ -405,6 +440,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a manual run is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
@@ -414,6 +450,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'sourced',
     principalKinds: ['personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -424,6 +461,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'sourced',
     principalKinds: ['personal_api_key', 'oauth_access_token', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -434,6 +472,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: execution history is governed by workspace role; logs.cost and logs.trace_spans withhold fields inside a run, not the right to read one
@@ -443,6 +482,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: a paused execution's detail is pause points and resume state, not the run's execution data — the fields logs.cost and logs.trace_spans withhold never appear here
@@ -452,6 +492,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   /**
@@ -482,6 +523,7 @@ export const workflowOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: stopping a run already in flight is governed by workspace role
@@ -491,6 +533,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
   // permission-group-exempt: answering a paused run is governed by workspace role
@@ -500,6 +543,7 @@ export const workflowOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/workflows/application/read-workflow-run.ts b/apps/sim/lib/workflows/application/read-workflow-run.ts
index 5e82ce9c77e..ad29de11189 100644
--- a/apps/sim/lib/workflows/application/read-workflow-run.ts
+++ b/apps/sim/lib/workflows/application/read-workflow-run.ts
@@ -1,10 +1,12 @@
 import { isValidUuid } from '@sim/utils/id'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   FUNCTIONAL_OUTPUTS_UNAVAILABLE_MESSAGE,
   FunctionalOutputsUnavailableError,
 } from '@/lib/logs/execution/functional-outputs'
 import { logProjectionSubjectUserId } from '@/lib/logs/projection'
+import { admitRunFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowRunApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -61,6 +63,8 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
       assertedWorkflowId: input.workflowId,
     }),
   async execute({ principal, context, input }) {
+    /** Only inlined file bytes are sourced content here; they are admitted per file below. */
+    await admitContent(principal, [])
     try {
       /**
        * The projection subject, not an attribution: a workspace API key
@@ -122,12 +126,24 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
           workflowId: context.workflowId,
           runId: context.runId,
         })
+        const includeBase64 = input.includeFileBase64 === true
+        /** Inlined base64 is opaque to text redaction, so each file is inlined only if admitted. */
+        const inlineable =
+          runFiles && includeBase64
+            ? await admitRunFiles(
+                principal,
+                context.workspaceId,
+                [...runFiles.filesById.values()],
+                'opaque'
+              )
+            : undefined
         files = runFiles
           ? await describeWorkflowRunFiles(runFiles.filesById, {
               workflowId: context.workflowId,
               runId: context.runId,
-              includeBase64: input.includeFileBase64 === true,
+              includeBase64,
               base64MaxBytes: input.base64MaxBytes,
+              ...(inlineable ? { inlineable } : {}),
             })
           : []
       }
diff --git a/apps/sim/lib/workflows/application/resume-run.ts b/apps/sim/lib/workflows/application/resume-run.ts
index c21f1972da9..c2f04d6af6d 100644
--- a/apps/sim/lib/workflows/application/resume-run.ts
+++ b/apps/sim/lib/workflows/application/resume-run.ts
@@ -1,4 +1,5 @@
 import { resolvePrincipalAttribution } from '@sim/auth/principal'
+import { withholdUnadmittedInlineFiles } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
 import { resolveActiveWorkflowRunApplicationContext } from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
@@ -22,7 +23,7 @@ export const resumeWorkflowRun = defineAuthorizedWorkflowUseCase({
     const attribution = resolvePrincipalAttribution(principal, {
       workspaceBillingOwnerUserId: context.billedAccountUserId,
     })
-    return executeResumeWorkflow({
+    const result = await executeResumeWorkflow({
       workflowId: context.workflowId,
       executionId: context.runId,
       contextId: input.contextId,
@@ -33,5 +34,7 @@ export const resumeWorkflowRun = defineAuthorizedWorkflowUseCase({
       pollingSurface: 'v2',
       allowStreaming: false,
     })
+    /** A resumed run inlines its output files, which are admitted per file like a fresh run's. */
+    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
   },
 })
diff --git a/apps/sim/lib/workflows/custom-blocks/application/settings.ts b/apps/sim/lib/workflows/custom-blocks/application/settings.ts
index ff06fae8128..2a33bce0c97 100644
--- a/apps/sim/lib/workflows/custom-blocks/application/settings.ts
+++ b/apps/sim/lib/workflows/custom-blocks/application/settings.ts
@@ -36,6 +36,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.list',
     minimumRole: 'read',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   publish: defineWorkspaceOperation({
@@ -43,6 +44,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.publish',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   update: defineWorkspaceOperation({
@@ -50,6 +52,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.update',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   delete: defineWorkspaceOperation({
@@ -57,6 +60,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.delete',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
   // permission-group-exempt: custom block settings retain source-workspace administration and deployment entitlement policy.
   usages: defineWorkspaceOperation({
@@ -64,6 +68,7 @@ export const customBlockSettingsOperations = {
     id: 'custom_blocks.usages',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 const authorizationOptions = { delegation: { audience: 'sim:settings', isWithinScope: () => true } }
diff --git a/apps/sim/lib/workflows/executor/execution-run-files.ts b/apps/sim/lib/workflows/executor/execution-run-files.ts
index 8b1ed18ec9c..f67d85db851 100644
--- a/apps/sim/lib/workflows/executor/execution-run-files.ts
+++ b/apps/sim/lib/workflows/executor/execution-run-files.ts
@@ -142,6 +142,8 @@ export interface DescribeWorkflowRunFilesOptions {
   includeBase64: boolean
   /** Inline ceiling per file. Clamped to the executor's own inline limit. */
   base64MaxBytes?: number
+  /** Files whose bytes may be inlined; any other file is described with `base64: null`. */
+  inlineable?: ReadonlySet<string>
 }
 
 /**
@@ -184,9 +186,12 @@ export async function describeWorkflowRunFiles(
   if (!options.includeBase64) {
     return files.map((file) => describe(file, null))
   }
+  const inlined = options.inlineable
+    ? files.filter((file) => options.inlineable?.has(file.id))
+    : files
 
   let declaredBytes = 0
-  for (const file of files) {
+  for (const file of inlined) {
     const downloadPath = workflowRunFileDownloadPath(options.workflowId, options.runId, file.id)
     if (file.size > cap) {
       throw new OrchestrationError(
@@ -202,6 +207,7 @@ export async function describeWorkflowRunFiles(
 
   let inlinedBytes = 0
   return mapWithConcurrency(files, INLINE_RUN_FILE_CONCURRENCY, async (file) => {
+    if (options.inlineable && !options.inlineable.has(file.id)) return describe(file, null)
     let content: Buffer
     try {
       content = await downloadFile({
diff --git a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
index 60790ff9539..dae19c5f9a2 100644
--- a/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
+++ b/apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts
@@ -30,6 +30,7 @@ vi.mock('@/lib/uploads/core/setup.server', () => ({
   },
 }))
 
+import { ContentDeliveryUnobservedError } from '@/lib/core/application'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import {
@@ -47,7 +48,6 @@ import {
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/download-workspace-file'
-import { WorkspaceFileDeliveryUnobservedError } from '@/lib/workspace-files/application/file-delivery-observer'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import '@/app/api/v2/files/[fileId]/text/route'
@@ -208,7 +208,7 @@ describe('chat-delegated file version history', () => {
     expect(projected.value).toContain('token=[REDACTED_SECRET]')
 
     const untracked = await chatTransport(fixture, fixture.bobId)(url)
-    expect(untracked.status).toBe(503)
+    expect(untracked.status).toBe(403)
     const refusal = await untracked.text()
     expect(refusal).not.toContain(SECRET)
     expect(refusal).toContain('provenance is unavailable')
@@ -287,7 +287,7 @@ describe('chat-delegated file version history', () => {
     expect((await versionRows(fixture.fileId)).map((row) => row.version)).toEqual([1, 2, 3])
   })
 
-  it('refuses a delegated version read that no delivery observer records', async () => {
+  it('refuses a delegated version read that no content gate admits', async () => {
     const fixture = await seedVersionedFile()
 
     const response = await chatTransport(fixture, fixture.bobId, undefined, { observer: false })(
@@ -412,15 +412,15 @@ describe('chat-delegated file version history', () => {
     expect(projected.value).toContain('token=[REDACTED_SECRET]')
 
     const untracked = await chatTransport(fixture, fixture.bobId)(url)
-    expect(untracked.status).toBe(503)
+    expect(untracked.status).toBe(403)
     expect(await untracked.text()).not.toContain(SECRET)
   })
 
   /**
-   * The current-file text read and download admitted Chat whether or not a delivery observer would
+   * The current-file text read and download admitted Chat whether or not a content gate would
    * record the secret provenance of the bytes; only the transport Chat composes today installed one.
    */
-  describe('current-file reads without a delivery observer', () => {
+  describe('current-file reads without a content gate', () => {
     async function revertToSecretVersion(fixture: Awaited<ReturnType<typeof seedVersionedFile>>) {
       const reverted = await chatTransport(fixture, fixture.aliceId)(
         `/api/v2/files/${fixture.fileId}/versions/2/revert`,
@@ -475,7 +475,7 @@ describe('chat-delegated file version history', () => {
       )
 
       await expect(inWorkspace(fixture, () => download(fixture, principal))).rejects.toThrow(
-        WorkspaceFileDeliveryUnobservedError
+        ContentDeliveryUnobservedError
       )
     })
 
diff --git a/apps/sim/lib/workspace-files/api/route-policies.ts b/apps/sim/lib/workspace-files/api/route-policies.ts
index 031cdba674a..c8b62bd6020 100644
--- a/apps/sim/lib/workspace-files/api/route-policies.ts
+++ b/apps/sim/lib/workspace-files/api/route-policies.ts
@@ -6,12 +6,7 @@ import {
 } from '@/lib/api/server/routes'
 import { ArchiveError, statusForArchiveError } from '@/lib/uploads/archive'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
-import { WorkspaceFileDeliveryUnobservedError } from '@/lib/workspace-files/application/file-delivery-observer'
-import {
-  v2CaughtOrchestrationError,
-  v2Error,
-  v2ErrorForOrchestration,
-} from '@/app/api/v2/lib/response'
+import { v2CaughtOrchestrationError, v2ErrorForOrchestration } from '@/app/api/v2/lib/response'
 
 export const internalSessionOrExecutorAuth = createInternalSessionOrExecutorAuth({
   audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
@@ -34,12 +29,6 @@ export const v2FileErrorPolicies = {
   default: v2OrchestrationErrorPolicy,
   concealResourceAuthorization: createV2ResourceConcealmentPolicy({
     notFoundMessage: 'File not found',
-    render(error) {
-      if (error instanceof WorkspaceFileDeliveryUnobservedError) {
-        return v2Error('SERVICE_UNAVAILABLE', error.message)
-      }
-      return v2CaughtOrchestrationError(error)
-    },
   }) satisfies V2ErrorPolicy,
   /**
    * Resource-ID upload controls conceal the *authorization* failure as absence,
diff --git a/apps/sim/lib/workspace-files/application/admit-file-content.ts b/apps/sim/lib/workspace-files/application/admit-file-content.ts
new file mode 100644
index 00000000000..3e8a8898fa0
--- /dev/null
+++ b/apps/sim/lib/workspace-files/application/admit-file-content.ts
@@ -0,0 +1,148 @@
+import type { Principal } from '@sim/auth/principal'
+import {
+  admitContent,
+  admitEach,
+  ContentRefusedError,
+  type ContentView,
+  mustClassifyContent,
+  requireAdmittedContent,
+} from '@/lib/core/application'
+import {
+  getBoundWorkspaceFileSecretProvenance,
+  getBoundWorkspaceFileSecretProvenanceByIdentity,
+  type WorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenanceIdentity,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { OwnedFileContext, OwnedFileNamespace } from '@/lib/workspace-files/owned-files'
+
+/** What a classification is bound to; a workspace file record satisfies it. */
+interface ClassifiableFile {
+  id: string
+  key: string
+  storageContext?: WorkspaceFileSecretProvenanceIdentity['context']
+  /** An owned file's namespace, which names the owner context its row is stored under. */
+  vfsNamespace?: 'uploads' | OwnedFileNamespace
+  contentUpdatedAt?: Date | null
+}
+
+const OWNED_CONTEXT_BY_NAMESPACE = {
+  tests: 'test',
+  changelog: 'changelog',
+} as const satisfies Record<OwnedFileNamespace, OwnedFileContext>
+
+/** The identity a classification is bound to: these exact bytes of this exact canonical file. */
+export function workspaceFileProvenanceIdentity(
+  file: ClassifiableFile
+): WorkspaceFileSecretProvenanceIdentity {
+  return {
+    fileId: file.id,
+    key: file.key,
+    context:
+      file.storageContext ??
+      (file.vfsNamespace && file.vfsNamespace !== 'uploads'
+        ? OWNED_CONTEXT_BY_NAMESPACE[file.vfsNamespace]
+        : 'workspace'),
+    contentUpdatedAt: file.contentUpdatedAt ?? undefined,
+  }
+}
+
+/**
+ * Admits one file's content before its bytes load, refusing it with a `403` when the surface's
+ * gate does. `provenance` is passed when the caller holds a classification bound to a snapshot
+ * other than the current file, such as a historical version. A caller no gate observes is admitted
+ * without a provenance read.
+ */
+export async function requireAdmittedWorkspaceFile(
+  principal: Principal,
+  workspaceId: string,
+  file: ClassifiableFile,
+  view: ContentView,
+  provenance?: WorkspaceFileSecretProvenance
+): Promise<void> {
+  if (!mustClassifyContent(principal)) {
+    await admitContent(principal, [])
+    return
+  }
+  await requireAdmittedContent(principal, {
+    kind: 'workspace-file',
+    id: file.id,
+    provenance:
+      provenance ??
+      (await getBoundWorkspaceFileSecretProvenance(
+        workspaceId,
+        workspaceFileProvenanceIdentity(file)
+      )),
+    view,
+  })
+}
+
+/**
+ * Admits the other files a render embedded, after it ran and before its bytes leave. A render is
+ * one output its contributors cannot be separated from, so it is admitted only when every one is.
+ */
+export async function admitContributors(
+  principal: Principal,
+  workspaceId: string,
+  contributors: readonly WorkspaceFileSecretProvenanceIdentity[] | undefined,
+  view: ContentView
+): Promise<boolean> {
+  if (!contributors?.length || !mustClassifyContent(principal)) return true
+  const provenance = await getBoundWorkspaceFileSecretProvenanceByIdentity(
+    workspaceId,
+    contributors
+  )
+  const sources = contributors.map((identity) => ({
+    kind: 'workspace-file' as const,
+    id: identity.fileId,
+    provenance: provenance.get(identity.fileId) ?? { status: 'unknown' as const },
+    view,
+  }))
+  return (await admitContent(principal, sources)).refused.length === 0
+}
+
+/** {@link admitContributors} for a single render: a refused contributor refuses it with a `403`. */
+export async function requireAdmittedContributors(
+  ...args: Parameters<typeof admitContributors>
+): Promise<void> {
+  if (!(await admitContributors(...args))) {
+    throw new ContentRefusedError('workspace-file')
+  }
+}
+
+/**
+ * Admits each of many files on its own, classifying all of them in one batch, and returns the ids
+ * admitted. A caller no gate observes gets every id back without a provenance read.
+ */
+export async function admitWorkspaceFileIdentities(
+  principal: Principal,
+  workspaceId: string,
+  identities: readonly WorkspaceFileSecretProvenanceIdentity[],
+  view: ContentView
+): Promise<Set<string>> {
+  const admitted = await admitEach(principal, identities, async (items) => {
+    const provenance = await getBoundWorkspaceFileSecretProvenanceByIdentity(workspaceId, items)
+    return items.map((identity) => ({
+      kind: 'workspace-file' as const,
+      id: identity.fileId,
+      provenance: provenance.get(identity.fileId) ?? { status: 'unknown' as const },
+      view,
+    }))
+  })
+  return new Set(admitted.map((identity) => identity.fileId))
+}
+
+/** {@link admitWorkspaceFileIdentities} over file records, returning the admitted records in order. */
+export async function admitWorkspaceFiles<F extends ClassifiableFile>(
+  principal: Principal,
+  workspaceId: string,
+  files: readonly F[],
+  view: ContentView
+): Promise<F[]> {
+  const admitted = await admitWorkspaceFileIdentities(
+    principal,
+    workspaceId,
+    files.map(workspaceFileProvenanceIdentity),
+    view
+  )
+  return files.filter((file) => admitted.has(file.id))
+}
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
index ddb450623fe..19d10a8b0b2 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts
@@ -9,6 +9,10 @@ import {
   permissionGroupsResolveMockFns,
 } from '@sim/testing/mocks/permission-groups-resolve.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import {
   workspaceUploadsMock,
   workspaceUploadsMockFns,
@@ -39,22 +43,30 @@ vi.mock('@/lib/uploads/utils/doc-not-ready', () => ({
   isDocNotReadyError: mockIsDocNotReady,
 }))
 vi.mock('@sim/audit', () => auditMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application'
+
+const mockProvenance =
+  workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity
 
 import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { downloadWorkspaceFileItems } from '@/lib/workspace-files/application/download-workspace-file-items'
 
-const { mockGetUserPermissionConfig } = permissionGroupsResolveMockFns
+const { mockResolveVerifiedUserAccessControlContext: mockAccessContext } =
+  permissionGroupsResolveMockFns
 const {
   mockIsGeneratedDocumentSourceType: mockIsGenerated,
   mockIsRenderableDocumentName: mockIsRenderable,
 } = fileUtilsMockFns
 
-/** The use case passes the organization the authorized context already loaded. */
-permissionGroupsResolveMockFns.mockResolveVerifiedUserAccessControlContext.mockImplementation(
-  async (userId: string, workspaceId: string) => ({
-    config: await mockGetUserPermissionConfig(userId, workspaceId),
-  })
-)
 fileUtilsMockFns.mockFormatFileSize.mockImplementation((bytes: number) => `${bytes} bytes`)
 fileUtilsMockFns.mockNeedsRenderedArtifact.mockImplementation(
   (contentType: string | null | undefined, fileName: string) =>
@@ -77,6 +89,17 @@ const workspace = {
   billedAccountUserId: 'billing-owner',
 }
 
+/** Chat's gate with no registry: an archive is opaque, so only secret-free files are admitted. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+
 function file(id: string, name: string, folderId: string | null = null, size = 10) {
   return { id, name, folderId, size, type: 'application/octet-stream', key: `key-${id}` }
 }
@@ -100,17 +123,107 @@ describe('downloadWorkspaceFileItems', () => {
     mockIsGenerated.mockReturnValue(false)
     mockIsRenderable.mockReturnValue(false)
     mockIsDocNotReady.mockReturnValue(false)
-    mockGetUserPermissionConfig.mockResolvedValue(null)
+    mockAccessContext.mockResolvedValue({
+      organizationId: null,
+      entitled: false,
+      permissionGroup: null,
+      config: null,
+    })
+    mockProvenance.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(identities.map((identity) => [identity.fileId, { status: 'exact', entries: [] }]))
+    )
   })
 
   it('allows a file-scoped delegated principal to download its one explicit file', async () => {
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: delegatedPrincipal,
+        input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
+      })
+    )
+
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+    expect(mockResolvePermission).toHaveBeenCalledOnce()
+    expect(mockProvenance).toHaveBeenCalledWith('ws-1', [
+      expect.objectContaining({ fileId: 'f1', key: 'key-f1' }),
+    ])
+  })
+
+  it('leaves out of a Chat archive each file its gate refuses, keeping the rest', async () => {
+    mockListFiles.mockResolvedValue([file('f1', 'clean.txt'), file('f2', 'secret.txt')])
+    mockProvenance.mockResolvedValue(
+      new Map([
+        ['f1', { status: 'exact', entries: [] }],
+        ['f2', { status: 'unknown' }],
+      ])
+    )
+    const chat = createDelegatedPrincipal({
+      subjectUserId: 'u1',
+      workspaceId: 'ws-1',
+      audience: 'sim:workspace-files',
+    })
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: chat,
+        input: { workspaceId: 'ws-1', fileIds: ['f1', 'f2'], folderIds: [] },
+      })
+    )
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+  })
+
+  it('counts only the zipped files once a rendered document is left out', async () => {
+    mockListFiles.mockResolvedValue([
+      file('f1', 'clean.txt', null, 10),
+      { ...file('f2', 'report.docx', null, 25), type: 'text/x-generated-document' },
+    ])
+    mockIsGenerated.mockImplementation((type) => type === 'text/x-generated-document')
+    mockFetchServable.mockResolvedValue({
+      buffer: Buffer.from('rendered'),
+      contributingFiles: [{ fileId: 'c1', key: 'key-c1', context: 'workspace' }],
+    })
+    mockProvenance.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(
+          identities.map((identity) => [
+            identity.fileId,
+            identity.fileId === 'c1' ? { status: 'unknown' } : { status: 'exact', entries: [] },
+          ])
+        )
+    )
+    const result = await observeContentDelivery(secretFreeGate, () =>
+      downloadWorkspaceFileItems.execute({
+        principal: createDelegatedPrincipal({
+          subjectUserId: 'u1',
+          workspaceId: 'ws-1',
+          audience: 'sim:workspace-files',
+        }),
+        input: { workspaceId: 'ws-1', fileIds: ['f1', 'f2'], folderIds: [] },
+      })
+    )
+    expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
+    expect(result.declaredBytes).toBe(10)
+  })
+
+  it('refuses a Chat archive whose every file its gate refuses', async () => {
+    mockProvenance.mockResolvedValue(new Map([['f1', { status: 'unknown' }]]))
+    await expect(
+      observeContentDelivery(secretFreeGate, () =>
+        downloadWorkspaceFileItems.execute({
+          principal: delegatedPrincipal,
+          input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
+        })
+      )
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('archives every selected file for a caller outside Chat without classifying', async () => {
     const result = await downloadWorkspaceFileItems.execute({
-      principal: delegatedPrincipal,
+      principal,
       input: { workspaceId: 'ws-1', fileIds: ['f1'], folderIds: [] },
     })
-
     expect(result.filesToZip.map((item) => item.id)).toEqual(['f1'])
-    expect(mockResolvePermission).toHaveBeenCalledOnce()
+    expect(mockProvenance).not.toHaveBeenCalled()
   })
 
   it.each([
@@ -199,9 +312,14 @@ describe('downloadWorkspaceFileItems', () => {
 
   describe('permission-group capability', () => {
     beforeEach(() => {
-      mockGetUserPermissionConfig.mockResolvedValue({
-        ...DEFAULT_PERMISSION_GROUP_CONFIG,
-        disableBulkFileDownload: true,
+      mockAccessContext.mockResolvedValue({
+        organizationId: null,
+        entitled: true,
+        permissionGroup: null,
+        config: {
+          ...DEFAULT_PERMISSION_GROUP_CONFIG,
+          disableBulkFileDownload: true,
+        },
       })
       mockListFolders.mockResolvedValue([{ id: 'folder-1', parentId: null, name: 'Reports' }])
       mockListFiles.mockImplementation(async () => {
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
index 011dabaf0c7..b5ef60ad4af 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file-items.ts
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import {
   type AuthorizedWorkspaceUseCaseContext,
+  ContentRefusedError,
   capabilityGovernedPrincipalUserId,
 } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -20,13 +21,17 @@ import {
   MAX_RENDERED_DOCUMENT_BYTES,
   needsRenderedArtifact,
 } from '@/lib/uploads/utils/file-utils'
+import {
+  admitContributors,
+  admitWorkspaceFiles,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { parseWorkspaceFileFolderDisplayPath } from '@/lib/workspace-files/folder-display-path'
 import { MAX_ZIP_DOWNLOAD_FILES } from '@/lib/workspace-files/limits'
 
-export const MAX_ZIP_DOWNLOAD_BYTES = 250 * 1024 * 1024
+const MAX_ZIP_DOWNLOAD_BYTES = 250 * 1024 * 1024
 const MAX_REQUESTED_FILE_IDS = 1_000
 const MAX_REQUESTED_FOLDER_IDS = 1_000
 
@@ -47,6 +52,7 @@ export interface DownloadWorkspaceFileItemsResult {
   folderPaths: Map<string, string>
   renderedDocuments: Map<string, Buffer>
   declaredBytes: number
+  excludedFileIds: string[]
 }
 
 function collectDescendantFolderIds(
@@ -98,6 +104,14 @@ function validationError(message: string): never {
   throw new OrchestrationError('validation', message)
 }
 
+function validateDeclaredBytes(bytes: number): void {
+  if (bytes > MAX_ZIP_DOWNLOAD_BYTES) {
+    validationError(
+      `Selected files total ${formatFileSize(bytes)}, which exceeds the ${formatFileSize(MAX_ZIP_DOWNLOAD_BYTES)} download limit.`
+    )
+  }
+}
+
 async function executeDownloadWorkspaceFileItems({
   input,
   context,
@@ -157,29 +171,31 @@ async function executeDownloadWorkspaceFileItems({
     folders
   )
   const requestedFileIds = new Set(fileIds)
-  const filesToZip = files.filter(
+  const selectedFiles = files.filter(
     (file) =>
       requestedFileIds.has(file.id) ||
       (file.folderId != null && selectedFolderIds.has(file.folderId))
   )
 
-  if (filesToZip.length === 0) validationError('No files selected for download')
-  if (filesToZip.length > MAX_ZIP_DOWNLOAD_FILES) {
+  if (selectedFiles.length === 0) validationError('No files selected for download')
+  if (selectedFiles.length > MAX_ZIP_DOWNLOAD_FILES) {
     validationError(
       `Too many files selected for download. Select ${MAX_ZIP_DOWNLOAD_FILES} or fewer files.`
     )
   }
-
-  const declaredBytes = filesToZip.reduce((sum, file) => sum + file.size, 0)
-  if (declaredBytes > MAX_ZIP_DOWNLOAD_BYTES) {
-    validationError(
-      `Selected files total ${formatFileSize(declaredBytes)}, which exceeds the ${formatFileSize(MAX_ZIP_DOWNLOAD_BYTES)} download limit.`
-    )
-  }
+  /** An archive is opaque to redaction, so each file enters it only when its gate admits it. */
+  let filesToZip = await admitWorkspaceFiles(
+    principal,
+    context.workspaceId,
+    selectedFiles,
+    'opaque'
+  )
 
   const reservedForStreamed = filesToZip
     .filter((file) => !needsRenderedArtifact(file.type, file.name))
     .reduce((sum, file) => sum + file.size, 0)
+  let declaredBytes = reservedForStreamed
+  validateDeclaredBytes(declaredBytes)
   const renderedDocuments = new Map<string, Buffer>()
   const pendingNames: string[] = []
   let renderedBytes = 0
@@ -189,12 +205,24 @@ async function executeDownloadWorkspaceFileItems({
     const remaining = Math.max(0, MAX_ZIP_DOWNLOAD_BYTES - reservedForStreamed - renderedBytes)
     const allowance = Math.min(remaining, MAX_RENDERED_DOCUMENT_BYTES)
     try {
-      const { buffer } = await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
-        maxBytes: allowance,
-      })
+      const { buffer, contributingFiles } = await fetchAuthorizedServableWorkspaceFileBuffer(
+        file,
+        principal,
+        { maxBytes: allowance }
+      )
+      if (!(await admitContributors(principal, context.workspaceId, contributingFiles, 'opaque'))) {
+        filesToZip = filesToZip.filter((admitted) => admitted.id !== file.id)
+        continue
+      }
+      declaredBytes += file.size
+      validateDeclaredBytes(declaredBytes)
       renderedBytes += buffer.length
       renderedDocuments.set(file.id, buffer)
     } catch (error) {
+      if (error instanceof ContentRefusedError) {
+        filesToZip = filesToZip.filter((admitted) => admitted.id !== file.id)
+        continue
+      }
       if (error instanceof PayloadSizeLimitError) {
         validationError(
           allowance === MAX_RENDERED_DOCUMENT_BYTES
@@ -210,8 +238,19 @@ async function executeDownloadWorkspaceFileItems({
   if (pendingNames.length > 0) {
     throw new OrchestrationError('conflict', docNotReadyMessage(pendingNames))
   }
+  if (filesToZip.length === 0) {
+    throw new ContentRefusedError('workspace-file')
+  }
 
-  return { filesToZip, folderPaths, renderedDocuments, declaredBytes }
+  const included = new Set(filesToZip.map((file) => file.id))
+  return {
+    excludedFileIds: selectedFiles.filter((file) => !included.has(file.id)).map((file) => file.id),
+    filesToZip,
+    folderPaths,
+    renderedDocuments,
+    /** Counted over what is zipped, after any rendered document whose contributors were refused. */
+    declaredBytes,
+  }
 }
 
 async function resolveDownloadContext({ input }: { input: DownloadWorkspaceFileItemsInput }) {
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
index 00f1b45f8d2..5b3a5376fe1 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file.test.ts
@@ -1,5 +1,8 @@
 import { Readable } from 'node:stream'
-import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import {
+  createDelegatedPrincipal,
+  createSessionPrincipal,
+} from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
 import { storageServiceMock, storageServiceMockFns } from '@sim/testing/mocks/storage-service.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
@@ -12,7 +15,13 @@ import {
   workspaceFileSecretProvenanceMockFns,
 } from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 
 class FakeDocNotReadyError extends Error {}
 
@@ -42,6 +51,8 @@ import { downloadWorkspaceFileStream } from '@/lib/workspace-files/application/d
 
 const mocks = {
   provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+  byIdentity:
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity,
   downloadStream: storageServiceMockFns.mockDownloadFileStream,
   getFile: workspaceFileManagerMockFns.mockGetWorkspaceFile,
   loadContext: workspaceFileManagerMockFns.mockLoadActiveWorkspaceFileContext,
@@ -100,6 +111,7 @@ const uploadedPdf = {
 }
 
 const SESSION = createSessionPrincipal()
+const CHAT = createDelegatedPrincipal({ audience: WORKSPACE_FILES_DELEGATION_AUDIENCE })
 
 async function readAll(stream: ReadableStream<Uint8Array>): Promise<string> {
   return new Response(stream).text()
@@ -121,24 +133,72 @@ describe('workspace file downloads', () => {
     })
   })
 
-  it('observes canonical private provenance before returning while keeping public results unchanged', async () => {
+  it('classifies a Chat download by its canonical provenance before opening storage', async () => {
     const provenance = { status: 'exact', entries: [] }
     mocks.provenance.mockResolvedValue(provenance)
-    const observe = vi.fn(async () => {})
-    const result = await observeWorkspaceFileDelivery(observe, () => downloadStream('file-2'))
-    expect(observe).toHaveBeenCalledWith(provenance, file.id)
-    expect(result.secretProvenance).toBeUndefined()
+    mocks.getFile.mockResolvedValue(plainFile)
+    const admit = vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => true))
+    const result = await observeContentDelivery({ admit }, () =>
+      downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+    )
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'workspace-file', id: plainFile.id, provenance, view: 'complete' },
+    ])
+    expect(admit.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.downloadStream.mock.invocationCallOrder[0]
+    )
+    expect(result.contentType).toBe('text/csv')
   })
-  it('does not return content if the private delivery observer refuses', async () => {
+
+  it('refuses a Chat download its gate refuses with a 403, before opening storage', async () => {
     mocks.provenance.mockResolvedValue({ status: 'unknown' })
+    mocks.getFile.mockResolvedValue(plainFile)
     await expect(
-      observeWorkspaceFileDelivery(
-        async () => {
-          throw new Error('no evidence')
+      observeContentDelivery({ admit: async (sources) => sources.map(() => false) }, () =>
+        downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+      )
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.downloadStream).not.toHaveBeenCalled()
+  })
+
+  it('refuses a Chat download no gate observes', async () => {
+    mocks.getFile.mockResolvedValue(plainFile)
+    await expect(
+      downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: plainFile.id } })
+    ).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+    expect(mocks.provenance).not.toHaveBeenCalled()
+    expect(mocks.downloadStream).not.toHaveBeenCalled()
+  })
+
+  it('refuses a rendered document for Chat when a file it embeds is refused', async () => {
+    const embedded = {
+      fileId: 'file-embedded',
+      key: 'workspace/workspace-1/logo.png',
+      context: 'workspace' as const,
+    }
+    mocks.getFile.mockResolvedValue(generatedDoc)
+    mocks.provenance.mockResolvedValue({ status: 'exact', entries: [] })
+    mocks.fetchServable.mockResolvedValue({
+      buffer: Buffer.from('%PDF-compiled'),
+      contentType: 'application/pdf',
+      contributingFiles: [embedded],
+    })
+    mocks.byIdentity.mockResolvedValue(new Map([[embedded.fileId, { status: 'unknown' }]]))
+    await expect(
+      observeContentDelivery(
+        {
+          admit: async (sources) => sources.map((source) => source.provenance.status !== 'unknown'),
         },
-        () => downloadStream('file-2')
+        () => downloadWorkspaceFileStream.execute({ principal: CHAT, input: { fileId: 'file-3' } })
       )
-    ).rejects.toThrow('no evidence')
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+  })
+
+  it('reads no provenance for a session download, which no gate classifies', async () => {
+    mocks.getFile.mockResolvedValue(plainFile)
+    const result = await downloadStream(plainFile.id)
+    expect(await readAll(result.stream)).toBe('pdf')
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 
   /** Resolving an artifact costs a full buffer, so it is reserved for generation sources. */
diff --git a/apps/sim/lib/workspace-files/application/download-workspace-file.ts b/apps/sim/lib/workspace-files/application/download-workspace-file.ts
index d787ea0164d..279b013eb47 100644
--- a/apps/sim/lib/workspace-files/application/download-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/download-workspace-file.ts
@@ -7,18 +7,13 @@ import {
   type ActiveWorkspaceFileContext,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { MAX_RENDERED_DOCUMENT_BYTES, needsRenderedArtifact } from '@/lib/uploads/utils/file-utils'
-import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
+import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -26,8 +21,6 @@ import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/applica
 export interface DownloadWorkspaceFileInput {
   fileId: string
   assertedWorkspaceId?: string
-  /** Trusted runtime callers can request the classification bound to the streamed bytes. */
-  includeSecretProvenance?: boolean
 }
 
 export interface DownloadWorkspaceFileResult {
@@ -43,7 +36,6 @@ export interface DownloadWorkspaceFileStreamResult extends DownloadWorkspaceFile
    */
   contentLength: number
   contentType: string
-  secretProvenance?: WorkspaceFileSecretProvenance
 }
 
 /** Audits the bytes actually handed out, which for a generated doc is not `file.size`. */
@@ -64,6 +56,7 @@ function projectDownloadAudit(file: DownloadWorkspaceFileResult['file'], servedB
 
 async function executeDownloadWorkspaceFile({
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.download,
   DownloadWorkspaceFileInput,
@@ -73,6 +66,8 @@ async function executeDownloadWorkspaceFile({
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
+  /** The record locates bytes its caller downloads without further redaction. */
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
   return { file }
 }
 
@@ -93,7 +88,6 @@ function resolveRenderedArtifact(
 }
 
 async function executeDownloadWorkspaceFileStream({
-  input,
   context,
   principal,
 }: AuthorizedWorkspaceUseCaseContext<
@@ -101,26 +95,12 @@ async function executeDownloadWorkspaceFileStream({
   DownloadWorkspaceFileInput,
   ActiveWorkspaceFileContext
 >): Promise<DownloadWorkspaceFileStreamResult> {
-  requireCopilotWorkspaceFileDeliveryObserver(principal)
   const file = await getWorkspaceFile(context.workspaceId, context.fileId, {
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
-  const secretProvenance =
-    input.includeSecretProvenance || hasWorkspaceFileDeliveryObserver()
-      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-        })
-      : undefined
-  await reportWorkspaceFileDelivery(secretProvenance, file.id)
-  return streamWorkspaceFileRecord(
-    file,
-    principal,
-    input.includeSecretProvenance ? secretProvenance : undefined
-  )
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
+  return streamWorkspaceFileRecord(file, principal)
 }
 
 /**
@@ -129,8 +109,7 @@ async function executeDownloadWorkspaceFileStream({
  */
 export async function streamWorkspaceFileRecord(
   file: DownloadWorkspaceFileResult['file'],
-  principal: Principal,
-  secretProvenance?: WorkspaceFileSecretProvenance
+  principal: Principal
 ): Promise<DownloadWorkspaceFileStreamResult> {
   /**
    * AI-generated docs store their generation SOURCE as the primary file and keep
@@ -142,7 +121,11 @@ export async function streamWorkspaceFileRecord(
    * double peak memory.
    */
   if (needsRenderedArtifact(file.type, file.name)) {
-    const { buffer, contentType } = await resolveRenderedArtifact(file, principal)
+    const { buffer, contentType, contributingFiles } = await resolveRenderedArtifact(
+      file,
+      principal
+    )
+    await requireAdmittedContributors(principal, file.workspaceId, contributingFiles, 'complete')
     return {
       file,
       stream: new ReadableStream<Uint8Array>({
@@ -155,7 +138,6 @@ export async function streamWorkspaceFileRecord(
       }),
       contentLength: buffer.length,
       contentType,
-      ...(secretProvenance ? { secretProvenance } : {}),
     }
   }
 
@@ -168,7 +150,6 @@ export async function streamWorkspaceFileRecord(
     stream: nodeReadableToWebStream(stream),
     contentLength: file.size,
     contentType: file.type || 'application/octet-stream',
-    ...(secretProvenance ? { secretProvenance } : {}),
   }
 }
 
diff --git a/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
index 95a78802487..00ed639b85c 100644
--- a/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/edit-workspace-file-content.ts
@@ -16,6 +16,7 @@ import {
   type VersionedWorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace'
 import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { parseWorkspaceFileRevision } from '@/lib/workspace-files/application/file-revision'
 import { resolveWorkspaceFileVersionWrite } from '@/lib/workspace-files/application/file-version-write'
@@ -116,6 +117,11 @@ export const editWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
        * that is merely too big. The post-edit check below covers the other
        * direction, where an edit grows a file past the same ceiling.
        */
+      /**
+       * An edit's answers — not found, ambiguous, how many matches — are read off the stored text,
+       * so it is admitted as text before a byte is read.
+       */
+      await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
       let buffer: Buffer
       try {
         buffer = await fetchWorkspaceFileBuffer(file, {
diff --git a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
index 482409d2376..e58263566ec 100644
--- a/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
+++ b/apps/sim/lib/workspace-files/application/export-workspace-file-snapshot.ts
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import type { Principal } from '@sim/auth/principal'
 import { PASTE_LIMITS, utf8ByteLength } from '@sim/utils/paste'
+import { admitContent } from '@/lib/core/application'
 import { asOrchestrationError, OrchestrationError } from '@/lib/core/orchestration/types'
 import { MATERIALIZE_CONCURRENCY, mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
@@ -45,6 +46,8 @@ export const exportWorkspaceFileSnapshot = defineAuthorizedWorkspaceFileUseCase(
       throw new OrchestrationError('validation', 'Markdown snapshot is too large')
     }
 
+    /** The snapshot text is the caller's own; each embedded asset is admitted by its record read. */
+    await admitContent(principal, [])
     const { ids } = extractEmbeddedFileRefs(input.content)
     const targets = await mapWithConcurrency(ids, MATERIALIZE_CONCURRENCY, async (imageId) => {
       try {
diff --git a/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts b/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
index 725740ed411..fb1eca6f949 100644
--- a/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
+++ b/apps/sim/lib/workspace-files/application/fetch-servable-workspace-file-buffer.ts
@@ -2,19 +2,23 @@ import type { Principal } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { generateRequestId } from '@/lib/core/utils/request'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
-import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import {
+  downloadServableFileFromStorage,
+  type ServableFile,
+} from '@/lib/uploads/utils/file-utils.server'
 
 const logger = createLogger('FetchServableWorkspaceFileBuffer')
 
 /**
  * Resolves the rendered bytes of an already-authorized workspace file while preserving the
- * Principal for any referenced-file reads performed by the document compiler.
+ * Principal for any referenced-file reads performed by the document compiler. The result names
+ * every other file the render embedded, whose content those bytes now carry.
  */
 export async function fetchAuthorizedServableWorkspaceFileBuffer(
   fileRecord: WorkspaceFileRecord,
   filePrincipal: Principal,
   options: { maxBytes: number; signal?: AbortSignal; requestId?: string }
-): Promise<{ buffer: Buffer; contentType: string }> {
+): Promise<ServableFile> {
   return downloadServableFileFromStorage(
     {
       id: fileRecord.id,
diff --git a/apps/sim/lib/workspace-files/application/file-delivery-observer.ts b/apps/sim/lib/workspace-files/application/file-delivery-observer.ts
deleted file mode 100644
index aae029b5e71..00000000000
--- a/apps/sim/lib/workspace-files/application/file-delivery-observer.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-import type { Principal } from '@sim/auth/principal'
-import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
-
-/** `fileId` names the canonical file the classification belongs to, for attribution only. */
-type WorkspaceFileDeliveryObserver = (
-  provenance: WorkspaceFileSecretProvenance | undefined,
-  fileId: string
-) => Promise<void>
-
-const observer = new AsyncLocalStorage<WorkspaceFileDeliveryObserver>()
-/** Internal transport evidence observes authorized bytes without changing public API admission or output. */
-export function observeWorkspaceFileDelivery<T>(
-  observe: WorkspaceFileDeliveryObserver,
-  execute: () => T
-): T {
-  return observer.run(observe, execute)
-}
-export function hasWorkspaceFileDeliveryObserver(): boolean {
-  return observer.getStore() !== undefined
-}
-/**
- * Runs before the canonical use case returns bytes to its transport. An observer that refuses the
- * file throws, so its bytes are never read.
- */
-export async function reportWorkspaceFileDelivery(
-  provenance: WorkspaceFileSecretProvenance | undefined,
-  fileId: string
-): Promise<void> {
-  await observer.getStore()?.(provenance, fileId)
-}
-
-/** A Chat read reached stored bytes with no observer to record their secret provenance. */
-export class WorkspaceFileDeliveryUnobservedError extends Error {
-  constructor() {
-    super('File read provenance is unavailable. Retry the read.')
-    this.name = 'WorkspaceFileDeliveryUnobservedError'
-  }
-}
-
-/**
- * Refuses a Chat caller before any bytes load unless a delivery observer is installed, so a secret
- * in the content cannot reach a model without its provenance being recorded, whatever transport
- * composed the call. Keyed on the Copilot service, not on delegation: a workflow run is delegated
- * too, but its reads feed blocks rather than Chat's model, and nothing observes them.
- */
-export function requireCopilotWorkspaceFileDeliveryObserver(principal: Principal): void {
-  if (
-    principal.kind === 'delegated' &&
-    principal.serviceId === 'copilot' &&
-    !hasWorkspaceFileDeliveryObserver()
-  ) {
-    throw new WorkspaceFileDeliveryUnobservedError()
-  }
-}
diff --git a/apps/sim/lib/workspace-files/application/file-versions.ts b/apps/sim/lib/workspace-files/application/file-versions.ts
index 3c7825eb58c..20acf946c24 100644
--- a/apps/sim/lib/workspace-files/application/file-versions.ts
+++ b/apps/sim/lib/workspace-files/application/file-versions.ts
@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import type { CursorKey, ListSortOrder } from '@/lib/api/list-query'
+import { mustClassifyContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { notifyWorkspaceFilesChanged } from '@/lib/realtime/notify'
 import { getServePathPrefix } from '@/lib/uploads'
@@ -29,16 +30,12 @@ import {
 import { hasObjectNotFoundCause } from '@/lib/uploads/core/errors'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 import { formatFileSize } from '@/lib/uploads/utils/file-utils'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
   type DownloadWorkspaceFileStreamResult,
   streamWorkspaceFileRecord,
 } from '@/lib/workspace-files/application/download-workspace-file'
-import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
 import { parseWorkspaceFileRevision } from '@/lib/workspace-files/application/file-revision'
 import { resolveWorkspaceFileVersionWrite } from '@/lib/workspace-files/application/file-version-write'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
@@ -125,10 +122,11 @@ async function loadVersion(
 }
 
 async function readVersionSecretProvenance(
+  principal: Principal,
   file: WorkspaceFileRecord,
   version: WorkspaceFileVersionRecord
 ): Promise<WorkspaceFileSecretProvenance | undefined> {
-  if (!hasWorkspaceFileDeliveryObserver()) return undefined
+  if (!mustClassifyContent(principal)) return undefined
   if (version.isCurrent) {
     return getBoundWorkspaceFileSecretProvenance(file.workspaceId, {
       fileId: file.id,
@@ -220,11 +218,10 @@ export const readWorkspaceFileVersionText = defineAuthorizedWorkspaceFileUseCase
     principal,
     request,
   }): Promise<ReadWorkspaceFileVersionTextResult> {
-    requireCopilotWorkspaceFileDeliveryObserver(principal)
     const file = await loadActiveFile(context)
     const version = await loadVersion(file, input.version)
     const fileAtVersion = recordAtVersion(file, version)
-    const secretProvenance = await readVersionSecretProvenance(file, version)
+    const secretProvenance = await readVersionSecretProvenance(principal, file, version)
     const result = await readVersionObject(version.version, () =>
       extractWorkspaceFileRecordText(
         fileAtVersion,
@@ -245,7 +242,13 @@ export const downloadWorkspaceFileVersion = defineAuthorizedWorkspaceFileUseCase
   async execute({ input, context, principal }): Promise<DownloadWorkspaceFileVersionResult> {
     const file = await loadActiveFile(context)
     const version = await loadVersion(file, input.version)
-    await reportWorkspaceFileDelivery(await readVersionSecretProvenance(file, version), file.id)
+    await requireAdmittedWorkspaceFile(
+      principal,
+      file.workspaceId,
+      file,
+      'complete',
+      await readVersionSecretProvenance(principal, file, version)
+    )
     const result = await readVersionObject(version.version, () =>
       streamWorkspaceFileRecord(recordAtVersion(file, version), principal)
     )
diff --git a/apps/sim/lib/workspace-files/application/operations.ts b/apps/sim/lib/workspace-files/application/operations.ts
index e0d7417886b..c96ff002871 100644
--- a/apps/sim/lib/workspace-files/application/operations.ts
+++ b/apps/sim/lib/workspace-files/application/operations.ts
@@ -26,7 +26,7 @@ const HUMAN_FILE_TOOL_PRINCIPAL_POLICY = {
 } as const
 /**
  * Chat may list, read and revert versions as the delegating user: a version text read refuses a
- * delegated caller unless a delivery observer records the snapshot's secret provenance, and a
+ * delegated caller unless the surface's content gate admits the snapshot's secret provenance, and a
  * revert writes a new, undoable version that reinstates that provenance. Deleting a version purges
  * history irreversibly, so it admits direct callers only. Download stays direct-only too, but it
  * is not a hard boundary for a writer: reverting to a version and downloading the current file
@@ -45,6 +45,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   readMetadata: defineWorkspaceOperation({
@@ -53,6 +54,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   readContent: defineWorkspaceOperation({
@@ -61,6 +63,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   searchContent: defineWorkspaceOperation({
@@ -69,6 +72,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   download: defineWorkspaceOperation({
@@ -77,6 +81,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   compiledCheck: defineWorkspaceOperation({
@@ -92,6 +97,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   rename: defineWorkspaceOperation({
@@ -100,6 +106,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   /**
@@ -120,6 +127,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   updateContent: defineWorkspaceOperation({
@@ -128,6 +136,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateMetadata: defineWorkspaceOperation({
@@ -136,6 +145,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   move: defineWorkspaceOperation({
@@ -144,6 +154,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   delete: defineWorkspaceOperation({
@@ -152,6 +163,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   restore: defineWorkspaceOperation({
@@ -160,6 +172,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_COPILOT_PRINCIPAL_POLICY,
   }),
   listVersions: defineWorkspaceOperation({
@@ -168,6 +181,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   readVersion: defineWorkspaceOperation({
@@ -176,6 +190,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   readVersionContent: defineWorkspaceOperation({
@@ -184,6 +199,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   downloadVersion: defineWorkspaceOperation({
@@ -200,6 +216,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...VERSION_HISTORY_PRINCIPAL_POLICY,
   }),
   deleteVersion: defineWorkspaceOperation({
@@ -216,6 +233,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateShare: defineWorkspaceOperation({
@@ -224,6 +242,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'deny',
     capability: 'files.use',
+    contentDelivery: 'sourced',
     ...HUMAN_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   listFolders: defineWorkspaceOperation({
@@ -232,6 +251,7 @@ export const fileOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   createFolder: defineWorkspaceOperation({
@@ -240,6 +260,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   updateFolder: defineWorkspaceOperation({
@@ -248,6 +269,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   deleteFolder: defineWorkspaceOperation({
@@ -256,6 +278,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   restoreFolder: defineWorkspaceOperation({
@@ -264,6 +287,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...ALL_FILE_TOOL_PRINCIPAL_POLICY,
   }),
   uploadCreate: defineWorkspaceOperation({
@@ -272,6 +296,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   /**
@@ -294,6 +319,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   uploadComplete: defineWorkspaceOperation({
@@ -302,6 +328,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
   uploadCancel: defineWorkspaceOperation({
@@ -310,6 +337,7 @@ export const fileOperations = {
     minimumRole: 'write',
     workspaceApiKey: 'allow',
     capability: 'files.use',
+    contentDelivery: 'none',
     ...UPLOAD_PRINCIPAL_POLICY,
   }),
 } as const
diff --git a/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts b/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
index acdb813194e..a28e3966c26 100644
--- a/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
+++ b/apps/sim/lib/workspace-files/application/read-stored-workspace-file-record-by-key.ts
@@ -7,6 +7,7 @@ import {
 import { type FileMetadataRecord, getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import { isWorkspaceScopedContext } from '@/lib/uploads/shared/types'
 import { tryInferContextFromKey } from '@/lib/uploads/utils/file-utils'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { workspaceFileDelegationPolicy } from '@/lib/workspace-files/application/authorization'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
@@ -70,7 +71,7 @@ export const readStoredWorkspaceFileRecordByKey = defineAuthorizedWorkspaceUseCa
           principal.resourceScope.chatId === context.file.chatId),
     },
   },
-  async execute({ input, context }): Promise<{ file: FileMetadataRecord }> {
+  async execute({ input, context, principal }): Promise<{ file: FileMetadataRecord }> {
     const file = await getFileMetadataByKey(input.key)
     if (
       !file ||
@@ -84,6 +85,18 @@ export const readStoredWorkspaceFileRecordByKey = defineAuthorizedWorkspaceUseCa
     ) {
       throw new StoredWorkspaceFileUnavailableError()
     }
+    /** Callers read and hand on this key's raw bytes, which no redaction reaches. */
+    await requireAdmittedWorkspaceFile(
+      principal,
+      context.workspaceId,
+      {
+        id: file.id,
+        key: file.key,
+        storageContext: context.file.context === 'mothership' ? 'mothership' : 'workspace',
+        contentUpdatedAt: file.contentUpdatedAt,
+      },
+      'opaque'
+    )
     return { file }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
index 833c62aa781..f6c2f7041fc 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.test.ts
@@ -27,14 +27,42 @@ vi.mock('@/lib/workspace-files/application/resolve-rendered-workspace-artifact',
   resolveRenderedWorkspaceArtifact: hoisted.render,
 }))
 
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { readWorkspaceFileArtifact } from '@/lib/workspace-files/application/read-workspace-file-artifact'
 
 const mocks = {
   permission: workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission,
   context: workspaceFileReferenceMockFns.mockResolveReferencedWorkspaceFileContext,
   ...hoisted,
-  safe: workspaceFileSecretProvenanceMockFns.mockIsOpaqueWorkspaceFileEgressSafe,
+  provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+}
+
+/** Records each item it is asked about and admits only the ones with no recorded secret. */
+const decided: unknown[] = []
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    decided.push(...sources)
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
 }
+const chatPrincipal = createCopilotChatFilePrincipal({
+  userId: 'u',
+  workspaceId: 'ws',
+  chatId: 'chat',
+})
+const readAsChat = () =>
+  observeContentDelivery(secretFreeGate, () =>
+    readWorkspaceFileArtifact.execute({ principal: chatPrincipal, input })
+  )
 
 const principal: Principal = createSessionPrincipal({ userId: 'u', sessionId: 's' })
 const input = { workspaceId: 'ws', reference: 'files/report.pdf', maxBytes: 1024 }
@@ -48,8 +76,9 @@ const file = {
 
 describe('authorized artifact observations', () => {
   beforeEach(() => {
+    decided.length = 0
     mocks.permission.mockResolvedValue('read')
-    mocks.safe.mockResolvedValue(true)
+    mocks.provenance.mockResolvedValue({ status: 'exact', entries: [] })
     mocks.context.mockResolvedValue({
       workspaceId: 'ws',
       fileId: 'file',
@@ -68,14 +97,37 @@ describe('authorized artifact observations', () => {
     mocks.permission.mockResolvedValue(null)
     await expect(readWorkspaceFileArtifact.execute({ principal, input })).rejects.toThrow()
     expect(mocks.render).not.toHaveBeenCalled()
-    expect(mocks.safe).not.toHaveBeenCalled()
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 
-  it('refuses model-unsafe bytes before reading or compiling, even when the actor can read the file', async () => {
-    mocks.safe.mockResolvedValue(false)
-    await expect(readWorkspaceFileArtifact.execute({ principal, input })).rejects.toThrow(
-      'File cannot be sent to a model'
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'u' }] },
+  ])(
+    'refuses Chat model-unsafe bytes before reading or compiling, even when the actor can read the file: %j',
+    async (provenance) => {
+      mocks.provenance.mockResolvedValue(provenance)
+      await expect(readAsChat()).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mocks.render).not.toHaveBeenCalled()
+    }
+  )
+
+  it('classifies the file as an opaque view bound to the bytes it renders', async () => {
+    expect((await readAsChat()).buffer).toEqual(Buffer.from('%PDF-1.7'))
+    expect(mocks.provenance).toHaveBeenCalledWith('ws', {
+      fileId: 'file',
+      key: 'canonical-key',
+      context: 'workspace',
+      contentUpdatedAt: file.contentUpdatedAt,
+    })
+    expect(decided).toEqual([expect.objectContaining({ id: 'file', view: 'opaque' })])
+  })
+
+  it('renders for a caller outside Chat without classifying', async () => {
+    mocks.provenance.mockResolvedValue({ status: 'unknown' })
+    expect((await readWorkspaceFileArtifact.execute({ principal, input })).buffer).toEqual(
+      Buffer.from('%PDF-1.7')
     )
-    expect(mocks.render).not.toHaveBeenCalled()
+    expect(mocks.provenance).not.toHaveBeenCalled()
   })
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
index ef4c968141b..3ac1df906bb 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-artifact.ts
@@ -1,9 +1,8 @@
 import type { Principal } from '@sim/auth/principal'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
-  isOpaqueWorkspaceFileEgressSafe,
-  MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
@@ -31,17 +30,17 @@ export const readWorkspaceFileArtifact = defineAuthorizedWorkspaceFileUseCase({
       includeOwnedFiles: true,
     }),
   async execute({ input, context, principal }) {
-    const file = context.file
-    const safe = await isOpaqueWorkspaceFileEgressSafe(context.workspaceId, {
-      fileId: file.id,
-      key: file.key,
-      context: file.storageContext ?? 'workspace',
-      ...(file.contentUpdatedAt ? { contentUpdatedAt: file.contentUpdatedAt } : {}),
-    })
-    if (!safe) throw new OrchestrationError('forbidden', MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE)
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, context.file, 'opaque')
     const artifact = await resolveRenderedWorkspaceArtifact(context.file, principal, {
       maxBytes: input.maxBytes,
     })
-    return { file: context.file, ...artifact }
+    /** An image of a document shows every file it embedded, none of which redaction can reach. */
+    await requireAdmittedContributors(
+      principal,
+      context.workspaceId,
+      artifact.contributingFiles,
+      'opaque'
+    )
+    return { file: context.file, buffer: artifact.buffer, contentType: artifact.contentType }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
index 0735d4db460..186a684b023 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content-by-key.ts
@@ -10,6 +10,7 @@ import {
 } from '@/lib/uploads/contexts/workspace'
 import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { assertOwnedFileAccess } from '@/lib/workspace-files/application/workspace-file-context'
@@ -44,12 +45,14 @@ async function loadCurrentWorkspaceFileByKey(
 async function executeReadWorkspaceFileContentByKey({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceFileByKeyInput,
   ActiveWorkspaceFileContext
 >): Promise<ReadWorkspaceFileContentByKeyResult> {
   const file = await loadCurrentWorkspaceFileByKey(input, context)
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
   return {
     file,
     content: await fetchWorkspaceFileBuffer(file, { maxBytes: MAX_BUFFERED_TRANSFER_BYTES }),
@@ -88,8 +91,11 @@ async function resolveWorkspaceFileByKeyContext({
 export const readWorkspaceFileRecordByKey = defineAuthorizedWorkspaceFileUseCase({
   operation: fileOperations.readContent,
   resolveContext: resolveWorkspaceFileByKeyContext,
-  async execute({ input, context }): Promise<ReadWorkspaceFileRecordByKeyResult> {
-    return { file: await loadCurrentWorkspaceFileByKey(input, context) }
+  async execute({ input, context, principal }): Promise<ReadWorkspaceFileRecordByKeyResult> {
+    const file = await loadCurrentWorkspaceFileByKey(input, context)
+    /** Callers serve this key's raw bytes, which no redaction reaches. */
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
+    return { file }
   },
 })
 
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
index 7298506e054..2d102681b9c 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-content.ts
@@ -1,5 +1,7 @@
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { isCopilotPrincipal } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import {
   type ActiveWorkspaceFileContext,
   fetchWorkspaceFileBuffer,
@@ -11,6 +13,10 @@ import {
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import {
+  requireAdmittedWorkspaceFile,
+  workspaceFileProvenanceIdentity,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -20,6 +26,8 @@ export interface ReadWorkspaceFileContentInput {
   assertedWorkspaceId?: string
   /** Optional post-authorization storage ceiling for bounded binary reads. */
   maxBytes?: number
+  /** Opaque model inputs bypass text projection and must be admitted before loading bytes. */
+  contentView?: 'complete' | 'opaque'
   includeDeleted?: boolean
   /** Loads the exact provenance bound to the authorized file version when requested. */
   includeSecretProvenance?: boolean
@@ -34,6 +42,7 @@ export interface ReadWorkspaceFileContentResult {
 async function executeReadWorkspaceFileContent({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceFileContentInput,
@@ -46,20 +55,40 @@ async function executeReadWorkspaceFileContent({
     includeOwnedFiles: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'File not found')
-  const content = await fetchWorkspaceFileBuffer(file, {
-    maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
-  })
-  const secretProvenance = input.includeSecretProvenance
-    ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-        fileId: file.id,
-        key: file.key,
-        context: file.storageContext ?? 'workspace',
-      })
-    : undefined
+  const secretProvenance =
+    input.includeSecretProvenance || isCopilotPrincipal(principal)
+      ? await getBoundWorkspaceFileSecretProvenance(
+          context.workspaceId,
+          workspaceFileProvenanceIdentity(file)
+        )
+      : undefined
+  await requireAdmittedWorkspaceFile(
+    principal,
+    context.workspaceId,
+    file,
+    input.contentView ?? 'complete',
+    secretProvenance
+  )
+  let content: Buffer
+  try {
+    content = await fetchWorkspaceFileBuffer(file, {
+      maxBytes: input.maxBytes ?? MAX_BUFFERED_TRANSFER_BYTES,
+    })
+  } catch (error) {
+    if (isPayloadSizeLimitError(error)) throw error
+    if (
+      isCopilotPrincipal(principal) &&
+      (secretProvenance?.status === 'unknown' ||
+        (secretProvenance?.status === 'exact' && secretProvenance.entries.length > 0))
+    ) {
+      throw new OrchestrationError('internal', 'File content could not be read')
+    }
+    throw error
+  }
   return {
     file,
     content,
-    ...(secretProvenance ? { secretProvenance } : {}),
+    ...(input.includeSecretProvenance && secretProvenance ? { secretProvenance } : {}),
   }
 }
 
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
index f36cf5bb52f..2bb7530e78d 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-mount.ts
@@ -1,4 +1,3 @@
-import { createLogger } from '@sim/logger'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { SandboxFile } from '@/lib/execution/remote-sandbox/types'
@@ -11,18 +10,16 @@ import {
   fetchWorkspaceFileBuffer,
   getWorkspaceFile,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { isGeneratedDocumentSourceType } from '@/lib/uploads/utils/file-utils'
+import {
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
 
-const logger = createLogger('WorkspaceFileMount')
-
 export interface ReadWorkspaceFileMountInput {
   fileId: string
   assertedWorkspaceId: string
@@ -34,7 +31,6 @@ export interface ReadWorkspaceFileMountInput {
 export interface ReadWorkspaceFileMountResult {
   mount: SandboxFile
   budget: SandboxMountBudget
-  secretProvenance: WorkspaceFileSecretProvenance
 }
 
 /** Prepares one private runtime mount from one authorized canonical file version. */
@@ -52,6 +48,12 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
     })
     if (!file) throw new OrchestrationError('not_found', 'File not found')
     input.signal?.throwIfAborted()
+    /**
+     * Classified before any byte is read, bound to the storage key the mount reads: a key is never
+     * rewritten in place, so the bytes mounted below are the bytes this classification describes.
+     */
+    await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'complete')
+    input.signal?.throwIfAborted()
     const mounts: SandboxFile[] = []
     const budget = { ...input.budget }
     const rendersFromSource = isGeneratedDocumentSourceType(file.type)
@@ -65,19 +67,27 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
         rendersFromSource,
         readInline: async (maxBytes) => {
           input.signal?.throwIfAborted()
-          const buffer = rendersFromSource
-            ? (
-                await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
-                  maxBytes,
-                  signal: input.signal,
-                }).catch((error) => {
-                  if (!isPayloadSizeLimitError(error)) throw error
-                  throw new Error(
-                    `Input file "${input.mountPath}" renders to more than the ${MAX_INLINE_MOUNT_FILE_BYTES / 1024 / 1024}MB per-file mount limit, or than the mount budget left. Mount fewer or smaller files.`
-                  )
-                })
-              ).buffer
-            : await fetchWorkspaceFileBuffer(file, { maxBytes })
+          let buffer: Buffer
+          if (rendersFromSource) {
+            const rendered = await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
+              maxBytes,
+              signal: input.signal,
+            }).catch((error) => {
+              if (!isPayloadSizeLimitError(error)) throw error
+              throw new Error(
+                `Input file "${input.mountPath}" renders to more than the ${MAX_INLINE_MOUNT_FILE_BYTES / 1024 / 1024}MB per-file mount limit, or than the mount budget left. Mount fewer or smaller files.`
+              )
+            })
+            await requireAdmittedContributors(
+              principal,
+              context.workspaceId,
+              rendered.contributingFiles,
+              'complete'
+            )
+            buffer = rendered.buffer
+          } else {
+            buffer = await fetchWorkspaceFileBuffer(file, { maxBytes })
+          }
           input.signal?.throwIfAborted()
           return {
             content: buffer.toString('base64'),
@@ -89,21 +99,8 @@ export const readWorkspaceFileMount = defineAuthorizedWorkspaceFileUseCase({
       budget
     )
     input.signal?.throwIfAborted()
-    /** A changed or absent revision cannot certify the bytes already selected above. */
-    const secretProvenance: WorkspaceFileSecretProvenance = file.contentUpdatedAt
-      ? await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt,
-        }).catch((error) => {
-          logger.warn('Mount classification unavailable', { fileId: file.id, error })
-          return { status: 'unknown' } as const
-        })
-      : { status: 'unknown' }
-    input.signal?.throwIfAborted()
     const mount = mounts[0]
     if (!mount) throw new Error('File mount preparation returned no bytes or URL')
-    return { mount, budget, secretProvenance }
+    return { mount, budget }
   },
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
index cd7bce659e8..5d988956bc5 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-record.test.ts
@@ -4,12 +4,22 @@ import {
   workspaceFileManagerMock,
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
 vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => workspaceFileManagerMock)
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
+import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import {
   downloadWorkspaceFileRecord,
   readWorkspaceFileContentRecord,
@@ -88,4 +98,38 @@ describe('workspace file record reads', () => {
     ).rejects.toThrow()
     expect(mocks.getFile).not.toHaveBeenCalled()
   })
+
+  it('binds an owned file to the owner context its row is stored under', async () => {
+    const owned = {
+      ...file,
+      key: 'workspace/workspace-1/test-body.js',
+      vfsNamespace: 'tests' as const,
+      contentUpdatedAt: new Date('2026-01-01T00:00:00.000Z'),
+    }
+    mocks.getFile.mockResolvedValue(owned)
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance.mockResolvedValue(
+      {
+        status: 'exact',
+        entries: [],
+      }
+    )
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    await observeContentDelivery(admitAll, () =>
+      readWorkspaceFileContentRecord.execute({
+        principal: createCopilotChatFilePrincipal({
+          userId: 'user-1',
+          workspaceId: 'workspace-1',
+          chatId: 'chat-1',
+        }),
+        input: { fileId: 'file-1', assertedWorkspaceId: 'workspace-1' },
+      })
+    )
+    expect(
+      workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance
+    ).toHaveBeenCalledWith('workspace-1', expect.objectContaining({ context: 'test' }))
+  })
 })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
index cbd9d1965e0..f665a83c68b 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-record.ts
@@ -6,6 +6,7 @@ import {
   getWorkspaceFile,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
@@ -20,9 +21,8 @@ export interface ReadWorkspaceFileRecordResult {
 }
 
 /**
- * Record reads by id admit chat uploads: the sandbox mount reloads an `uploads/<name>`
- * upload through here before presigning it. Listings never surface chat uploads and
- * writes never resolve them.
+ * Record reads by id admit chat uploads. Listings never surface chat uploads and writes never
+ * resolve them.
  */
 function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(operation: O) {
   return defineAuthorizedWorkspaceFileUseCase({
@@ -41,6 +41,7 @@ function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(opera
       }),
     async execute({
       context,
+      principal,
     }: AuthorizedWorkspaceUseCaseContext<
       O,
       ReadWorkspaceFileRecordInput,
@@ -52,6 +53,8 @@ function createReadWorkspaceFileRecord<const O extends WorkspaceOperation>(opera
         includeOwnedFiles: true,
       })
       if (!file) throw new OrchestrationError('not_found', 'File not found')
+      /** Callers read and hand on the record's raw bytes, which no redaction reaches. */
+      await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
       return { file }
     },
   })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
index 3d6103307c0..cefbfe82b59 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-secret-provenance.ts
@@ -1,4 +1,5 @@
 import type { Principal } from '@sim/auth/principal'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
@@ -25,7 +26,7 @@ export const readWorkspaceFileSecretProvenance = defineAuthorizedWorkspaceFileUs
     principal: Principal
     input: ReadWorkspaceFileSecretProvenanceInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  async execute({ input, context }): Promise<{
+  async execute({ input, context, principal }): Promise<{
     provenance: WorkspaceFileSecretProvenance
     ownerUserId: string
   }> {
@@ -34,6 +35,8 @@ export const readWorkspaceFileSecretProvenance = defineAuthorizedWorkspaceFileUs
       includeOwnedFiles: true,
     })
     if (!file) throw new OrchestrationError('not_found', 'File not found')
+    /** A classification names secrets by ciphertext only and returns none of the file's content. */
+    await admitContent(principal, [])
     return {
       provenance: await getBoundWorkspaceFileSecretProvenance(context.workspaceId, {
         fileId: file.id,
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
index 1fa9e922d85..54fdf25422e 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.test.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import {
+  createDelegatedPrincipal,
   createPersonalApiKeyPrincipal,
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
@@ -19,8 +20,13 @@ import {
   workspaceUploadsMockFns,
 } from '@sim/testing/mocks/workspace-uploads.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ContentDeliveryUnobservedError,
+  ContentRefusedError,
+  type ContentSource,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { FileParserError } from '@/lib/file-parsers/errors'
-import { observeWorkspaceFileDelivery } from '@/lib/workspace-files/application/file-delivery-observer'
 
 const hoisted = vi.hoisted(() => ({
   fetchServable: vi.fn(),
@@ -41,7 +47,10 @@ vi.mock('@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 
 vi.mock('@/lib/file-parsers', () => fileParsersMock)
 
-import { readWorkspaceFileText } from '@/lib/workspace-files/application/read-workspace-file-text'
+import {
+  extractWorkspaceFileRecordText,
+  readWorkspaceFileText,
+} from '@/lib/workspace-files/application/read-workspace-file-text'
 
 const mocks = {
   provenance: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
@@ -82,6 +91,13 @@ function fileRecord(overrides: Record<string, unknown> = {}) {
   }
 }
 
+/** A record as the use case hands it to extraction, with the full shape provenance binds to. */
+function fileRecordForChat() {
+  return fileRecord({ contentUpdatedAt: new Date('2026-01-01T00:00:00.000Z') }) as Parameters<
+    typeof extractWorkspaceFileRecordText
+  >[0]
+}
+
 /** The canonical context the reference resolver hands back, carrying the record it resolved. */
 function referenceContext(overrides: Record<string, unknown> = {}) {
   return { ...fileContext, file: fileRecord(overrides) }
@@ -103,28 +119,49 @@ describe('readWorkspaceFileText', () => {
     mocks.parseBuffer.mockResolvedValue({ content: 'hello there!', metadata: {} })
   })
 
-  it('observes canonical private provenance before returning while keeping public results unchanged', async () => {
+  it('classifies a Chat read by its canonical provenance before reading any bytes', async () => {
     const provenance = { status: 'exact', entries: [] }
     mocks.provenance.mockResolvedValue(provenance)
-    const observe = vi.fn(async () => {})
-    const result = await observeWorkspaceFileDelivery(observe, () =>
-      readWorkspaceFileText.execute({ principal: principals[0], input: input() })
+    const admit = vi.fn(async (sources: readonly ContentSource[]) => sources.map(() => true))
+    const result = await observeContentDelivery({ admit }, () =>
+      extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
+    )
+    expect(admit).toHaveBeenCalledWith([
+      { kind: 'workspace-file', id: FILE_ID, provenance, view: 'complete' },
+    ])
+    expect(admit.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.fetchBuffer.mock.invocationCallOrder[0]
     )
-    expect(observe).toHaveBeenCalledWith(provenance, FILE_ID)
-    expect(result.secretProvenance).toBeUndefined()
+    expect(result.text).toBe('hello there!')
   })
-  it('does not return content if the private delivery observer refuses', async () => {
+
+  it('refuses a Chat read its gate refuses with a 403, before reading any bytes', async () => {
     mocks.provenance.mockResolvedValue({ status: 'unknown' })
     await expect(
-      observeWorkspaceFileDelivery(
-        async () => {
-          throw new Error('no evidence')
-        },
-        () => readWorkspaceFileText.execute({ principal: principals[0], input: input() })
+      observeContentDelivery({ admit: async (sources) => sources.map(() => false) }, () =>
+        extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
       )
-    ).rejects.toThrow('no evidence')
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.fetchBuffer).not.toHaveBeenCalled()
   })
 
+  it('refuses a Chat read no gate observes, before reading provenance or bytes', async () => {
+    await expect(
+      extractWorkspaceFileRecordText(fileRecordForChat(), {}, createDelegatedPrincipal())
+    ).rejects.toBeInstanceOf(ContentDeliveryUnobservedError)
+    expect(mocks.provenance).not.toHaveBeenCalled()
+    expect(mocks.fetchBuffer).not.toHaveBeenCalled()
+  })
+
+  it.each(principals)(
+    'reads no provenance for a $kind caller, which no gate classifies',
+    async (principal) => {
+      const result = await readWorkspaceFileText.execute({ principal, input: input() })
+      expect(result.text).toBe('hello there!')
+      expect(mocks.provenance).not.toHaveBeenCalled()
+    }
+  )
+
   it('uses the complete text representation before selecting a line window', async () => {
     const controller = new AbortController()
     mocks.parseBuffer.mockResolvedValueOnce({ content: 'header\ntail needle\n', metadata: {} })
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
index 82ad8f03edd..f7fb10bd89f 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-file-text.ts
@@ -1,6 +1,7 @@
 import type { Principal } from '@sim/auth/principal'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { AuthorizedWorkspaceUseCaseContext } from '@/lib/core/application'
+import { redactBeforeCutting } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isSupportedFileType } from '@/lib/file-parsers'
@@ -9,22 +10,18 @@ import {
   fetchWorkspaceFileBuffer,
   type WorkspaceFileRecord,
 } from '@/lib/uploads/contexts/workspace'
-import {
-  getBoundWorkspaceFileSecretProvenance,
-  type WorkspaceFileSecretProvenance,
-} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import type { WorkspaceFileSecretProvenance } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import {
   formatFileSize,
   getFileExtension,
   MAX_TEXT_EXTRACTION_BYTES,
   needsRenderedArtifact,
 } from '@/lib/uploads/utils/file-utils'
-import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import {
-  hasWorkspaceFileDeliveryObserver,
-  reportWorkspaceFileDelivery,
-  requireCopilotWorkspaceFileDeliveryObserver,
-} from '@/lib/workspace-files/application/file-delivery-observer'
+  requireAdmittedContributors,
+  requireAdmittedWorkspaceFile,
+} from '@/lib/workspace-files/application/admit-file-content'
+import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveRenderedWorkspaceArtifact } from '@/lib/workspace-files/application/resolve-rendered-workspace-artifact'
 import {
@@ -47,8 +44,6 @@ export interface ReadWorkspaceFileTextInput {
   offset?: number
   /** How many lines to return from `offset`. Absent reads to the end. */
   limit?: number
-  /** Private classification for runtime consumers, omitted from ordinary API reads. */
-  includeSecretProvenance?: boolean
   /** Internal agent reads can decode plain source files identified by their MIME type. */
   allowPlainText?: boolean
 }
@@ -74,7 +69,6 @@ export interface ReadWorkspaceFileTextResult {
     /** False when extraction was truncated, so `totalLines` is not the file's end. */
     totalLinesExact: boolean
   }
-  secretProvenance?: WorkspaceFileSecretProvenance
 }
 
 /**
@@ -115,7 +109,6 @@ async function executeReadWorkspaceFileText({
 >): Promise<ReadWorkspaceFileTextResult> {
   const signal = request?.signal
   signal?.throwIfAborted()
-  requireCopilotWorkspaceFileDeliveryObserver(principal)
   return extractWorkspaceFileRecordText(context.file, input, principal, signal)
 }
 
@@ -125,25 +118,18 @@ async function executeReadWorkspaceFileText({
  */
 export async function extractWorkspaceFileRecordText(
   file: WorkspaceFileRecord,
-  input: Pick<
-    ReadWorkspaceFileTextInput,
-    'maxBytes' | 'offset' | 'limit' | 'allowPlainText' | 'includeSecretProvenance'
-  >,
+  input: Pick<ReadWorkspaceFileTextInput, 'maxBytes' | 'offset' | 'limit' | 'allowPlainText'>,
   principal: Principal,
   signal?: AbortSignal,
   sourceProvenance?: WorkspaceFileSecretProvenance
 ): Promise<ReadWorkspaceFileTextResult> {
-  const secretProvenance =
-    sourceProvenance ??
-    (input.includeSecretProvenance || hasWorkspaceFileDeliveryObserver()
-      ? await getBoundWorkspaceFileSecretProvenance(file.workspaceId, {
-          fileId: file.id,
-          key: file.key,
-          context: file.storageContext ?? 'workspace',
-          contentUpdatedAt: file.contentUpdatedAt ?? undefined,
-        })
-      : undefined)
-  await reportWorkspaceFileDelivery(secretProvenance, file.id)
+  await requireAdmittedWorkspaceFile(
+    principal,
+    file.workspaceId,
+    file,
+    'complete',
+    sourceProvenance
+  )
 
   const extension = input.allowPlainText
     ? (workspaceFileTextFormat(file) ?? getFileExtension(file.name))
@@ -165,22 +151,33 @@ export async function extractWorkspaceFileRecordText(
    * is what the name promises, so it is what gets parsed. Matches the download
    * path, which resolves the same artifact for the same reason.
    */
-  const content = needsRenderedArtifact(file.type, file.name)
-    ? (
-        await resolveRenderedWorkspaceArtifact(file, principal, {
-          maxBytes,
-          signal,
-          tooLargeMessage: (limit) =>
-            `"${file.name}" renders to more than ${limit}, above the text-extraction limit; download the raw bytes instead of extracting text`,
-        })
-      ).buffer
-    : await readSourceBuffer(file, maxBytes, signal)
+  let content: Buffer
+  if (needsRenderedArtifact(file.type, file.name)) {
+    const rendered = await resolveRenderedWorkspaceArtifact(file, principal, {
+      maxBytes,
+      signal,
+      tooLargeMessage: (limit) =>
+        `"${file.name}" renders to more than ${limit}, above the text-extraction limit; download the raw bytes instead of extracting text`,
+    })
+    await requireAdmittedContributors(
+      principal,
+      file.workspaceId,
+      rendered.contributingFiles,
+      'complete'
+    )
+    content = rendered.buffer
+  } else {
+    content = await readSourceBuffer(file, maxBytes, signal)
+  }
   const parsed = await parseFileText(content, extension, file.name, signal)
   const metadata = parsed.metadata ?? {}
 
   const truncated = metadata.truncated === true
+  const ranged = input.offset !== undefined || input.limit !== undefined
   const { text, lineRange } = sliceFileTextLines(
-    parsed.content,
+    ranged
+      ? await redactBeforeCutting(principal, parsed.content, 'workspace-file')
+      : parsed.content,
     input.offset,
     input.limit,
     truncated
@@ -193,7 +190,6 @@ export async function extractWorkspaceFileRecordText(
     degraded: metadata.degraded === true,
     degradedReason: metadata.degraded === true ? (metadata.warning ?? null) : null,
     byteCount: content.byteLength,
-    ...(input.includeSecretProvenance && secretProvenance ? { secretProvenance } : {}),
     ...(lineRange ? { lineRange } : {}),
   }
 }
diff --git a/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts b/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
index cff1cc494c9..aa25d8bbaf8 100644
--- a/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
+++ b/apps/sim/lib/workspace-files/application/read-workspace-inline-file.ts
@@ -9,6 +9,7 @@ import {
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
+import { requireAdmittedWorkspaceFile } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
@@ -37,6 +38,7 @@ export interface ReadWorkspaceInlineFileResult {
 async function executeReadWorkspaceInlineFile({
   input,
   context,
+  principal,
 }: AuthorizedWorkspaceUseCaseContext<
   typeof fileOperations.readContent,
   ReadWorkspaceInlineFileInput,
@@ -46,6 +48,7 @@ async function executeReadWorkspaceInlineFile({
     throwOnError: true,
   })
   if (!file) throw new OrchestrationError('not_found', 'Not found')
+  await requireAdmittedWorkspaceFile(principal, context.workspaceId, file, 'opaque')
 
   const stream = await downloadFileStream({ key: file.key, context: 'workspace' })
   return {
diff --git a/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts b/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
index 889b8332789..30738ae67d6 100644
--- a/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
+++ b/apps/sim/lib/workspace-files/application/resolve-rendered-workspace-artifact.ts
@@ -4,6 +4,7 @@ import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { docNotReadyMessage, isDocNotReadyError } from '@/lib/uploads/utils/doc-not-ready'
 import { formatFileSize } from '@/lib/uploads/utils/file-utils'
+import type { ServableFile } from '@/lib/uploads/utils/file-utils.server'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 
 /**
@@ -31,7 +32,7 @@ export async function resolveRenderedWorkspaceArtifact(
   file: WorkspaceFileRecord,
   filePrincipal: Principal,
   options: { maxBytes: number; signal?: AbortSignal; tooLargeMessage?: (limit: string) => string }
-): Promise<{ buffer: Buffer; contentType: string }> {
+): Promise<ServableFile> {
   try {
     options.signal?.throwIfAborted()
     return await fetchAuthorizedServableWorkspaceFileBuffer(file, filePrincipal, {
diff --git a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
index e7c19d6811f..a561b4b5c9e 100644
--- a/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
+++ b/apps/sim/lib/workspace-files/application/resolve-workspace-file-reference.ts
@@ -1,5 +1,6 @@
 import type { Principal } from '@sim/auth/principal'
 import type { OperationUseCase, WorkspaceOperation } from '@/lib/core/application'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   type ActiveWorkspaceFileContext,
@@ -98,7 +99,9 @@ function defineWorkspaceFileReferenceUseCase<const O extends WorkspaceOperation>
       principal: Principal
       input: WorkspaceFileReferenceInput
     }) => resolveReferencedWorkspaceFileContext(principal, input, options),
-    async execute({ context }): Promise<WorkspaceFileReferenceResult> {
+    async execute({ context, principal }): Promise<WorkspaceFileReferenceResult> {
+      /** Resolution authorizes under the content operation but returns only the file's record. */
+      await admitContent(principal, [])
       return { file: context.file }
     },
   })
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
index 96a9cf85eb7..d2d644e4e1d 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.test.ts
@@ -1,5 +1,9 @@
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import {
   workspaceUploadsMock,
   workspaceUploadsMockFns,
@@ -15,10 +19,18 @@ vi.mock('@/lib/uploads/contexts/workspace', () => workspaceUploadsMock)
 vi.mock('@/lib/workspace-files/search/repository', () => ({
   searchWorkspaceFileIndex: hoisted.search,
 }))
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
 vi.mock('@/lib/workspace-files/resolve-folder-scope', () => ({
   resolveWorkspaceFolderScope: hoisted.folders,
 }))
 
+import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
+import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
+import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
+import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
 import { searchWorkspaceFileContent } from '@/lib/workspace-files/application/search-workspace-file-content'
 
 const mocks = {
@@ -60,3 +72,110 @@ describe('searchWorkspaceFileContent cancellation', () => {
     expect(mocks.search).not.toHaveBeenCalled()
   })
 })
+
+/** A clipped preview cannot reliably redact a value split by the index. */
+const cleanOnlyGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) => provenance.status === 'exact' && provenance.entries.length === 0
+    )
+  },
+}
+
+function copilotPrincipal() {
+  const copilot = createCopilotChatPrincipal(
+    { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
+    WORKSPACE_FILES_DELEGATION_AUDIENCE
+  )
+  markCopilotWorkspaceInvocation(copilot)
+  return copilot
+}
+
+function source(fileId: string) {
+  return { identity: { fileId, key: `key-${fileId}`, context: 'workspace' as const } }
+}
+
+function hit(fileId: string, lineNumber: number) {
+  return { fileId, lineNumber, text: `needle ${lineNumber}` }
+}
+
+describe('searchWorkspaceFileContent for Chat', () => {
+  beforeEach(() => {
+    mocks.load.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'user-1',
+    })
+    mocks.permission.mockResolvedValue('read')
+    workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity.mockImplementation(
+      async (_workspaceId: string, identities: readonly { fileId: string }[]) =>
+        new Map(
+          identities.map((identity) => [
+            identity.fileId,
+            identity.fileId === 'refused'
+              ? { status: 'unknown' }
+              : { status: 'exact', entries: [] },
+          ])
+        )
+    )
+  })
+
+  it('preserves match locations while withholding unreadable previews', async () => {
+    mocks.search.mockResolvedValue({
+      results: [hit('refused', 1), hit('clean', 3)],
+      count: 2,
+      truncated: false,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused'), source('clean')],
+    })
+    const found = await observeContentDelivery(cleanOnlyGate, () =>
+      searchWorkspaceFileContent.execute({
+        principal: copilotPrincipal(),
+        input: { ...input, maxResults: 2 },
+      })
+    )
+    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(2)
+    expect(found.results.map((result) => result.lineNumber)).toEqual([1, 3])
+    expect(found.results[0].text).toMatch(/preview withheld/i)
+    expect(found.results[1].text).toBe('needle 3')
+    expect(found).toMatchObject({ count: 2, truncated: false })
+    expect(found.sources.map((entry) => entry.identity.fileId)).toEqual(['clean'])
+  })
+
+  it('keeps truthful truncation when a page contains only unreadable previews', async () => {
+    mocks.search.mockResolvedValue({
+      results: [hit('refused', 1)],
+      count: 1,
+      truncated: true,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused')],
+    })
+    const found = await observeContentDelivery(cleanOnlyGate, () =>
+      searchWorkspaceFileContent.execute({
+        principal: copilotPrincipal(),
+        input: { ...input, maxResults: 1 },
+      })
+    )
+    expect(found).toMatchObject({ count: 1, truncated: true })
+    expect(found.results[0]).toMatchObject({ fileId: 'refused', lineNumber: 1 })
+    expect(found.results[0].text).toMatch(/preview withheld/i)
+  })
+
+  it("leaves a person's search limit and result untouched", async () => {
+    const raw = {
+      results: [hit('refused', 1)],
+      count: 1,
+      truncated: true,
+      complete: true,
+      indexStatus: 'ready',
+      sources: [source('refused')],
+    }
+    mocks.search.mockResolvedValue(raw)
+    const found = await searchWorkspaceFileContent.execute({ principal, input })
+    expect(mocks.search.mock.calls[0]?.[0].maxResults).toBe(input.maxResults)
+    expect(found).toBe(raw)
+  })
+})
diff --git a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
index 0c6e97ef267..b8baae70c61 100644
--- a/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/search-workspace-file-content.ts
@@ -1,5 +1,7 @@
+import { isCopilotPrincipal } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { loadActiveWorkspaceContext } from '@/lib/uploads/contexts/workspace'
+import { admitWorkspaceFileIdentities } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveWorkspaceFolderScope } from '@/lib/workspace-files/resolve-folder-scope'
@@ -61,13 +63,34 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     signal?.throwIfAborted()
 
     try {
-      return await searchWorkspaceFileIndex({
+      const classified = isCopilotPrincipal(principal)
+      const found = await searchWorkspaceFileIndex({
         workspaceId: context.workspaceId,
         pattern: compileFileSearchPattern(input.query, input.mode),
         maxResults: input.maxResults,
         folderScope,
         signal,
       })
+      /** Index previews are already clipped; protect them without changing match locations or totals. */
+      const admitted = await admitWorkspaceFileIdentities(
+        principal,
+        context.workspaceId,
+        found.sources.map((source) => source.identity),
+        'excerpt'
+      )
+      if (!classified) return found
+      return {
+        ...found,
+        results: found.results.map((result) =>
+          admitted.has(result.fileId)
+            ? result
+            : {
+                ...result,
+                text: '[Preview withheld: read or grep this file to inspect protected text.]',
+              }
+        ),
+        sources: found.sources.filter((source) => admitted.has(source.identity.fileId)),
+      }
     } catch (error) {
       /**
        * A rejected or too-expensive pattern is the caller's to fix, and the
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
index bed5d97e673..a6bd7b1da35 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.test.ts
@@ -7,6 +7,10 @@ import {
   workspaceFileManagerMock,
   workspaceFileManagerMockFns,
 } from '@sim/testing/mocks/workspace-file-manager.mock'
+import {
+  workspaceFileSecretProvenanceMock,
+  workspaceFileSecretProvenanceMockFns,
+} from '@sim/testing/mocks/workspace-file-secret-provenance.mock'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
@@ -17,7 +21,21 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => workspa
 
 vi.mock('@/ee/access-control/utils/permission-check', () => permissionCheckMock)
 
+vi.mock(
+  '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance',
+  () => workspaceFileSecretProvenanceMock
+)
+const provenance = {
+  bound: workspaceFileSecretProvenanceMockFns.mockGetBoundWorkspaceFileSecretProvenance,
+  current: workspaceFileSecretProvenanceMockFns.mockGetCurrentWorkspaceFileSecretProvenance,
+}
+
 import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
+import {
+  type ContentDeliveryGate,
+  ContentRefusedError,
+  observeContentDelivery,
+} from '@/lib/core/application'
 import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
@@ -39,6 +57,38 @@ const mocks = {
 
 const principal = createSessionPrincipal()
 
+/** Chat's gate with no registry: a link is opaque, so only a secret-free file is admitted. */
+const secretFreeGate: ContentDeliveryGate = {
+  async admit(sources) {
+    return sources.map(
+      ({ provenance }) =>
+        provenance.status === 'unrecorded' ||
+        (provenance.status === 'exact' && provenance.entries.length === 0)
+    )
+  },
+}
+const asChat = <T>(execute: () => T) => observeContentDelivery(secretFreeGate, execute)
+
+function copilotPrincipal() {
+  const copilot = createCopilotChatPrincipal(
+    { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
+    WORKSPACE_FILES_DELEGATION_AUDIENCE
+  )
+  markCopilotWorkspaceInvocation(copilot)
+  return copilot
+}
+
+/** Every file this suite shares reads as `provenance` now; clean unless a test says otherwise. */
+function currentProvenance(value: unknown) {
+  provenance.current.mockImplementation(
+    async (_workspaceId: string, ids: readonly string[]) => new Map(ids.map((id) => [id, value]))
+  )
+}
+
+beforeEach(() => {
+  currentProvenance({ status: 'exact', entries: [] })
+})
+
 describe('getWorkspaceFileShares', () => {
   beforeEach(() => {
     mocks.resolvePermission.mockResolvedValue('read')
@@ -78,6 +128,30 @@ describe('getWorkspaceFileShares', () => {
 
     expect(mocks.getWorkspaceShares).not.toHaveBeenCalled()
   })
+
+  it('shows Chat only the live links to files its gate admits', async () => {
+    mocks.getWorkspaceShares.mockResolvedValue(
+      new Map([
+        ['clean', { isActive: true }],
+        ['secret', { isActive: true }],
+        ['inactive', { isActive: false }],
+      ])
+    )
+    provenance.current.mockResolvedValue(
+      new Map([
+        ['clean', { status: 'exact', entries: [] }],
+        ['secret', { status: 'unknown' }],
+      ])
+    )
+    const { shares } = await asChat(() =>
+      getWorkspaceFileShares.execute({
+        principal: copilotPrincipal(),
+        input: { workspaceId: 'workspace-1', fileIds: ['clean', 'secret', 'inactive'] },
+      })
+    )
+    expect([...shares.keys()]).toEqual(['clean', 'inactive'])
+    expect(provenance.current).toHaveBeenCalledWith('workspace-1', ['clean', 'secret'])
+  })
 })
 
 describe('updateWorkspaceFileShare password references', () => {
@@ -88,15 +162,6 @@ describe('updateWorkspaceFileShare password references', () => {
     billedAccountUserId: 'billing-owner',
   }
 
-  function copilotPrincipal() {
-    const copilot = createCopilotChatPrincipal(
-      { userId: 'user-1', workspaceId: 'workspace-1', chatId: 'chat-1' },
-      WORKSPACE_FILES_DELEGATION_AUDIENCE
-    )
-    markCopilotWorkspaceInvocation(copilot)
-    return copilot
-  }
-
   function share(
     caller: Parameters<typeof updateWorkspaceFileShare.execute>[0]['principal'],
     password: string,
@@ -138,7 +203,7 @@ describe('updateWorkspaceFileShare password references', () => {
   it("stores the value of the agent's referenced variable, not the placeholder", async () => {
     environment({ SHARE_PW: 'resolved-share-password' })
 
-    await share(copilotPrincipal(), '{{SHARE_PW}}')
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))
 
     expect(environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables).toHaveBeenCalledWith(
       'user-1',
@@ -151,13 +216,52 @@ describe('updateWorkspaceFileShare password references', () => {
   })
 
   it('refuses an unset variable by name', async () => {
-    await expect(share(copilotPrincipal(), '{{SHARE_PW}}')).rejects.toMatchObject({
+    await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toMatchObject({
       code: 'validation',
       message: expect.stringContaining('Environment variable "SHARE_PW"'),
     })
     expect(mocks.upsertFileShare).not.toHaveBeenCalled()
   })
 
+  it.each([
+    { status: 'unknown' },
+    { status: 'exact', entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }] },
+  ])(
+    'refuses Chat a live link to a file holding a secret or of unknown provenance: %j',
+    async (refused) => {
+      currentProvenance(refused)
+      environment({ SHARE_PW: 'resolved-share-password' })
+      await expect(asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}'))).rejects.toBeInstanceOf(
+        ContentRefusedError
+      )
+      expect(mocks.upsertFileShare).not.toHaveBeenCalled()
+    }
+  )
+
+  it('lets a person share a file whatever its provenance', async () => {
+    currentProvenance({ status: 'unknown' })
+    await share(principal, 'a-long-literal-password-value')
+    expect(mocks.upsertFileShare).toHaveBeenCalled()
+    expect(provenance.current).not.toHaveBeenCalled()
+  })
+
+  it('refuses a secret-bearing file even under a gate that admits it, such as the workbench', async () => {
+    currentProvenance({
+      status: 'exact',
+      entries: [{ encryptedValue: 'ciphertext', sourceUserId: 'user-1' }],
+    })
+    environment({ SHARE_PW: 'resolved-share-password' })
+    const admitAll: ContentDeliveryGate = {
+      async admit(sources) {
+        return sources.map(() => true)
+      },
+    }
+    await expect(
+      observeContentDelivery(admitAll, () => share(copilotPrincipal(), '{{SHARE_PW}}'))
+    ).rejects.toBeInstanceOf(ContentRefusedError)
+    expect(mocks.upsertFileShare).not.toHaveBeenCalled()
+  })
+
   it('keeps a reference literal for any other caller, under the same rules', async () => {
     await expect(share(principal, '{{SHORT}}')).rejects.toMatchObject({
       code: 'validation',
@@ -175,7 +279,7 @@ describe('updateWorkspaceFileShare password references', () => {
 
   it('resolves only when the effective share mode is password', async () => {
     mocks.getShare.mockResolvedValue({ authType: 'email' })
-    await share(copilotPrincipal(), '{{SHARE_PW}}', {})
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}', {}))
     expect(environmentUtilsMockFns.mockResolveEffectiveEnvironmentVariables).not.toHaveBeenCalled()
     expect(mocks.upsertFileShare).toHaveBeenCalledWith(
       expect.objectContaining({ password: '{{SHARE_PW}}' })
@@ -183,7 +287,7 @@ describe('updateWorkspaceFileShare password references', () => {
 
     mocks.getShare.mockResolvedValue({ authType: 'password' })
     environment({ SHARE_PW: 'resolved-share-password' })
-    await share(copilotPrincipal(), '{{SHARE_PW}}', {})
+    await asChat(() => share(copilotPrincipal(), '{{SHARE_PW}}', {}))
     expect(mocks.upsertFileShare).toHaveBeenLastCalledWith(
       expect.objectContaining({ password: 'resolved-share-password' })
     )
diff --git a/apps/sim/lib/workspace-files/application/share-workspace-file.ts b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
index bfb2b0bf4c2..3b080c572ae 100644
--- a/apps/sim/lib/workspace-files/application/share-workspace-file.ts
+++ b/apps/sim/lib/workspace-files/application/share-workspace-file.ts
@@ -6,6 +6,7 @@ import {
   type ShareRecord,
   sharePasswordSchema,
 } from '@/lib/api/contracts/public-shares'
+import { admitContent, ContentRefusedError, isCopilotPrincipal } from '@/lib/core/application'
 import { resolveCopilotSecretReference } from '@/lib/core/application/environment-reference'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { parseExactEnvironmentReference } from '@/lib/environment/reference'
@@ -16,12 +17,22 @@ import {
   upsertFileShare,
 } from '@/lib/public-shares/share-manager'
 import {
+  findListedWorkspaceFiles,
   getWorkspaceFile,
   loadActiveWorkspaceContext,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import {
+  getBoundWorkspaceFileSecretProvenanceByIdentity,
+  getCurrentWorkspaceFileSecretProvenance,
+  type WorkspaceFileSecretProvenance,
+} from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
+import { downloadFileStream } from '@/lib/uploads/core/storage-service'
+import { getFileExtension, isRenderableDocumentName } from '@/lib/uploads/utils/file-utils'
+import { workspaceFileProvenanceIdentity } from '@/lib/workspace-files/application/admit-file-content'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { resolveActiveWorkspaceFileContext } from '@/lib/workspace-files/application/workspace-file-context'
+import { loadPublishedCompiledDocInputs } from '@/lib/workspace-files/compiled-document-store'
 import { MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS } from '@/lib/workspace-files/limits'
 import { validatePublicFileSharing } from '@/ee/access-control/utils/permission-check'
 
@@ -67,12 +78,60 @@ export class WorkspaceFileShareNoopError extends Error {
   }
 }
 
+/**
+ * A live link serves a file's current bytes to whoever opens it, outside every gate: no registry
+ * redacts them and no workbench history follows them. So Chat may create or see a link only to a
+ * file holding no recorded secret, whichever surface it acts through (D1).
+ */
+function isShareableByChat(provenance: WorkspaceFileSecretProvenance | undefined): boolean {
+  return (
+    provenance?.status === 'unrecorded' ||
+    (provenance?.status === 'exact' && provenance.entries.length === 0)
+  )
+}
+
+/** The ids whose live links Chat may see; every other caller sees them all, unread. */
+async function admitSharedFiles(
+  principal: Principal,
+  workspaceId: string,
+  fileIds: readonly string[]
+): Promise<Set<string>> {
+  await admitContent(principal, [])
+  if (!isCopilotPrincipal(principal) || fileIds.length === 0) return new Set(fileIds)
+  const provenance = await getCurrentWorkspaceFileSecretProvenance(workspaceId, fileIds)
+  const shareable = new Set(fileIds.filter((id) => isShareableByChat(provenance.get(id))))
+  if (shareable.size === 0) return shareable
+  const files = await findListedWorkspaceFiles(workspaceId, [...shareable])
+  for (const id of shareable) {
+    const file = files.get(id)
+    if (!file || file.id !== id || !isRenderableDocumentName(file.name)) continue
+    const source = await downloadFileStream({
+      key: file.key,
+      context: file.storageContext ?? 'workspace',
+    })
+    const contributors = await loadPublishedCompiledDocInputs(
+      workspaceId,
+      source,
+      getFileExtension(file.name)
+    )
+    const bound = await getBoundWorkspaceFileSecretProvenanceByIdentity(workspaceId, [
+      workspaceFileProvenanceIdentity(file),
+      ...contributors,
+    ])
+    if ([...bound.values()].some((value) => !isShareableByChat(value))) shareable.delete(id)
+  }
+  return shareable
+}
+
 export const getWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
   operation: fileOperations.readShare,
   resolveContext: ({ input }: { input: GetWorkspaceFileShareInput }) =>
     resolveActiveWorkspaceFileContext(input),
-  async execute({ context }): Promise<GetWorkspaceFileShareResult> {
+  async execute({ context, principal }): Promise<GetWorkspaceFileShareResult> {
     const share = await getShareForResource('file', context.fileId)
+    const active = share?.isActive ? [context.fileId] : []
+    const visible = await admitSharedFiles(principal, context.workspaceId, active)
+    if (active.length > visible.size) throw new ContentRefusedError('workspace-file')
     return { share }
   },
 })
@@ -84,7 +143,7 @@ export const getWorkspaceFileShares = defineAuthorizedWorkspaceFileUseCase({
     if (!workspace) throw new OrchestrationError('not_found', 'Workspace not found')
     return workspace
   },
-  async execute({ input, context }): Promise<GetWorkspaceFileSharesResult> {
+  async execute({ input, context, principal }): Promise<GetWorkspaceFileSharesResult> {
     const fileIds = [...new Set(input.fileIds)]
     if (fileIds.length > MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS) {
       throw new OrchestrationError(
@@ -92,8 +151,16 @@ export const getWorkspaceFileShares = defineAuthorizedWorkspaceFileUseCase({
         `Cannot read shares for more than ${MAX_WORKSPACE_FILE_BULK_AFFECTED_ITEMS} files`
       )
     }
+    const shares = await getWorkspaceSharesForResources('file', context.workspaceId, fileIds)
+    const admitted = await admitSharedFiles(
+      principal,
+      context.workspaceId,
+      [...shares].filter(([, share]) => share.isActive).map(([fileId]) => fileId)
+    )
     return {
-      shares: await getWorkspaceSharesForResources('file', context.workspaceId, fileIds),
+      shares: new Map(
+        [...shares].filter(([fileId, share]) => !share.isActive || admitted.has(fileId))
+      ),
     }
   },
 })
@@ -149,6 +216,10 @@ export const updateWorkspaceFileShare = defineAuthorizedWorkspaceFileUseCase({
     const effectiveAuthType = input.authType ?? existingShare?.authType ?? 'public'
     if (input.isActive) {
       await validatePublicFileSharing(userId, context.workspaceId, effectiveAuthType)
+      const [shareable] = await admitSharedFiles(principal, context.workspaceId, [context.fileId])
+      if (!shareable) throw new ContentRefusedError('workspace-file')
+    } else {
+      await admitContent(principal, [])
     }
 
     const password =
diff --git a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
index 6385bb119b9..1b84b8f1a9e 100644
--- a/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
+++ b/apps/sim/lib/workspace-files/application/update-workspace-file-content.ts
@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { type Principal, resolvePrincipalAttribution } from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
+import { admitContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   ContentVersionConflictError,
@@ -120,7 +121,10 @@ const admitUpdateWorkspaceFileContentUseCase = defineAuthorizedWorkspaceFileUseC
   operation: fileOperations.updateContent,
   resolveContext: ({ principal, input }: { principal: Principal; input: { fileId: string } }) =>
     resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  async execute() {},
+  /** Admission only; nothing is read. */
+  async execute({ principal }) {
+    await admitContent(principal, [])
+  },
 })
 
 export async function admitUpdateWorkspaceFileContent(
@@ -140,6 +144,8 @@ export const updateWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
     input: UpdateWorkspaceFileContentInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
   async execute({ principal, input, context }): Promise<UpdateWorkspaceFileContentResult> {
+    /** A replacement writes the caller's bytes and returns the file's metadata, never its content. */
+    await admitContent(principal, [])
     const content = Buffer.from(input.content, input.encoding === 'base64' ? 'base64' : 'utf-8')
     if (content.length > MAX_WORKSPACE_FILE_CONTENT_BYTES) {
       throw new OrchestrationError(
@@ -166,12 +172,14 @@ export const updateWorkspaceFileContentFromBuffer = defineAuthorizedWorkspaceFil
     principal: Principal
     input: UpdateWorkspaceFileContentBufferInput
   }) => resolveActiveWorkspaceFileContext({ ...input, ownedFilePrincipal: principal }),
-  execute: ({ principal, input, context }) =>
-    updateAuthorizedWorkspaceFileContent({
+  async execute({ principal, input, context }) {
+    await admitContent(principal, [])
+    return updateAuthorizedWorkspaceFileContent({
       principal,
       input,
       content: input.content,
       canonical: context,
-    }),
+    })
+  },
   projectAudit: ({ result }) => projectUpdateWorkspaceFileContentAudit(result),
 })
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts b/apps/sim/lib/workspace-files/compiled-document-store.test.ts
similarity index 99%
rename from apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts
rename to apps/sim/lib/workspace-files/compiled-document-store.test.ts
index b412d03e45d..0f2df8ae38a 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.test.ts
+++ b/apps/sim/lib/workspace-files/compiled-document-store.test.ts
@@ -4,12 +4,12 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('@/lib/uploads/core/storage-service', () => storageServiceMock)
 
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 import {
   loadCompiledDoc,
   loadPublishedCompiledDoc,
   storeCompiledDoc,
-} from '@/lib/mothership/tools/server/files/doc-compiled-store'
-import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+} from '@/lib/workspace-files/compiled-document-store'
 
 const { mockDownloadFile, mockUploadFile } = storageServiceMockFns
 
diff --git a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts b/apps/sim/lib/workspace-files/compiled-document-store.ts
similarity index 73%
rename from apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts
rename to apps/sim/lib/workspace-files/compiled-document-store.ts
index e98342a01e1..c78c69d55b9 100644
--- a/apps/sim/lib/mothership/tools/server/files/doc-compiled-store.ts
+++ b/apps/sim/lib/workspace-files/compiled-document-store.ts
@@ -1,13 +1,21 @@
 import { createHash } from 'node:crypto'
+import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
-import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { z } from 'zod'
+import { assertKnownSizeWithinLimit, isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import type { WorkspaceFileSecretProvenanceIdentity } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { isObjectNotFoundError } from '@/lib/uploads/core/errors'
 import { downloadFile, uploadFile } from '@/lib/uploads/core/storage-service'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
+import { OWNED_FILE_CONTEXTS } from '@/lib/workspace-files/owned-files'
 
 const logger = createLogger('CopilotDocCompiledStore')
 
+export const COMPILED_PDF_MAGIC = Buffer.from([0x25, 0x50, 0x44, 0x46, 0x2d])
+export const COMPILED_ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04])
+
 /**
  * Compiled-artifact store for Python-generated documents.
  *
@@ -35,6 +43,14 @@ function compiledArtifactKey(
 
 function publishedArtifactPointerKey(workspaceId: string, source: string, ext: string): string {
   const sourceHash = createHash('sha256').update(source, 'utf-8').digest('hex')
+  return publishedArtifactPointerKeyFromHash(workspaceId, sourceHash, ext)
+}
+
+function publishedArtifactPointerKeyFromHash(
+  workspaceId: string,
+  sourceHash: string,
+  ext: string
+): string {
   return `copilot-doc-compiled/${workspaceId}/${sourceHash}.${ext}.published.json`
 }
 
@@ -166,6 +182,63 @@ export async function publishCompiledDocArtifact(
   }
 }
 
+const publishedInputsSchema = z.object({
+  version: z.literal(1),
+  inputs: z.array(
+    z.object({
+      fileId: z.string().min(1),
+      key: z.string().min(1),
+      context: z.enum(['workspace', 'mothership', 'execution', ...OWNED_FILE_CONTEXTS]),
+      contentVersion: z.iso.datetime(),
+    })
+  ),
+})
+
+/**
+ * Reads the published artifact's captured input revisions without loading or rebuilding its bytes.
+ * Matches public format detection: binaries stop at their header; source is hashed as streamed UTF-8.
+ */
+export async function loadPublishedCompiledDocInputs(
+  workspaceId: string,
+  sourceStream: Readable,
+  ext: string
+): Promise<WorkspaceFileSecretProvenanceIdentity[]> {
+  const magic = ext === 'pdf' ? COMPILED_PDF_MAGIC : COMPILED_ZIP_MAGIC
+  let prefix = Buffer.alloc(0)
+  let total = 0
+  const hash = createHash('sha256')
+  const decoder = new StringDecoder('utf8')
+  for await (const chunk of sourceStream) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    if (prefix.length < magic.length) {
+      prefix = Buffer.concat([prefix, bytes.subarray(0, magic.length - prefix.length)])
+      if (prefix.equals(magic)) return []
+    }
+    total += bytes.length
+    assertKnownSizeWithinLimit(total, MAX_BUFFERED_TRANSFER_BYTES, 'Compiled document source')
+    hash.update(decoder.write(bytes), 'utf8')
+  }
+  hash.update(decoder.end(), 'utf8')
+  const pointer = await loadPublishedArtifactPointer(
+    publishedArtifactPointerKeyFromHash(workspaceId, hash.digest('hex'), ext)
+  )
+  if (!pointer) return []
+  let decoded: unknown
+  try {
+    decoded = JSON.parse(pointer.referencedInputIdentity)
+  } catch {
+    throw new Error('Published compiled document inputs are malformed')
+  }
+  const parsed = publishedInputsSchema.safeParse(decoded)
+  if (!parsed.success) throw new Error('Published compiled document inputs are invalid')
+  return parsed.data.inputs.map(({ fileId, key, context, contentVersion }) => ({
+    fileId,
+    key,
+    context,
+    contentUpdatedAt: new Date(contentVersion),
+  }))
+}
+
 /** Loads an artifact previously published by an authorized compile, or null before cutover. */
 export async function loadPublishedCompiledDoc(
   workspaceId: string,
diff --git a/apps/sim/lib/workspaces/application/inbox-settings.ts b/apps/sim/lib/workspaces/application/inbox-settings.ts
index ae81c7a2bd6..ff120a4c4f3 100644
--- a/apps/sim/lib/workspaces/application/inbox-settings.ts
+++ b/apps/sim/lib/workspaces/application/inbox-settings.ts
@@ -16,6 +16,7 @@ export const inboxSettingsOperations = {
     id: 'workspace_inbox.read',
     minimumRole: 'read',
     capability: 'inbox.use',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
@@ -24,6 +25,7 @@ export const inboxSettingsOperations = {
     id: 'workspace_inbox.update',
     minimumRole: 'admin',
     capability: 'inbox.use',
+    contentDelivery: 'none',
     workspaceApiKey: 'deny',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
diff --git a/apps/sim/lib/workspaces/application/manage-permissions.ts b/apps/sim/lib/workspaces/application/manage-permissions.ts
index 05f8723bdd3..6ba6c84e6e7 100644
--- a/apps/sim/lib/workspaces/application/manage-permissions.ts
+++ b/apps/sim/lib/workspaces/application/manage-permissions.ts
@@ -24,6 +24,7 @@ export const workspacePermissionOperations = {
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'none',
   }),
   /** permission-group-exempt: workspace administrators manage existing collaborator roles. */
   update: defineWorkspaceOperation({
@@ -33,6 +34,7 @@ export const workspacePermissionOperations = {
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 
diff --git a/apps/sim/lib/workspaces/application/operations.ts b/apps/sim/lib/workspaces/application/operations.ts
index 6700b46eb07..f7d23bb3493 100644
--- a/apps/sim/lib/workspaces/application/operations.ts
+++ b/apps/sim/lib/workspaces/application/operations.ts
@@ -23,6 +23,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -33,6 +34,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [...PUBLIC_API_PRINCIPAL_KINDS, 'delegated'],
     delegatedServices: ['copilot'],
   }),
diff --git a/apps/sim/lib/workspaces/application/organization-operations.ts b/apps/sim/lib/workspaces/application/organization-operations.ts
index 197cfccfaa1..50e13a88994 100644
--- a/apps/sim/lib/workspaces/application/organization-operations.ts
+++ b/apps/sim/lib/workspaces/application/organization-operations.ts
@@ -3,6 +3,7 @@ import { defineOrganizationOperation } from '@/lib/core/application/organization
 export const organizationWorkspaceOperations = {
   list: defineOrganizationOperation({
     id: 'organization.workspaces.list',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'copilot.use',
     principalKinds: ['session', 'organization_delegated'],
@@ -11,6 +12,7 @@ export const organizationWorkspaceOperations = {
   }),
   create: defineOrganizationOperation({
     id: 'organization.workspaces.create',
+    contentDelivery: 'none',
     minimumRole: 'member',
     capability: 'workspace.create',
     principalKinds: ['organization_delegated'],
diff --git a/apps/sim/lib/workspaces/application/remove-member.ts b/apps/sim/lib/workspaces/application/remove-member.ts
index 94a7f0110b7..6b1fb7990de 100644
--- a/apps/sim/lib/workspaces/application/remove-member.ts
+++ b/apps/sim/lib/workspaces/application/remove-member.ts
@@ -12,6 +12,7 @@ export const removeWorkspaceMemberOperation = defineWorkspaceOperation({
   minimumRole: 'read',
   workspaceApiKey: 'deny',
   capability: 'none',
+  contentDelivery: 'none',
   principalKinds: ['session', 'delegated'],
   delegatedServices: ['copilot'],
 })
diff --git a/apps/sim/lib/workspaces/operations/operations.ts b/apps/sim/lib/workspaces/operations/operations.ts
index 3395e64c8fd..31f44c87c5f 100644
--- a/apps/sim/lib/workspaces/operations/operations.ts
+++ b/apps/sim/lib/workspaces/operations/operations.ts
@@ -10,6 +10,7 @@ export const workspaceOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'allow',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: [
       'session',
       'personal_api_key',
diff --git a/packages/testing/src/mocks/workspace-file-manager.mock.ts b/packages/testing/src/mocks/workspace-file-manager.mock.ts
index 2dd10d8b6e0..a8189bef9f7 100644
--- a/packages/testing/src/mocks/workspace-file-manager.mock.ts
+++ b/packages/testing/src/mocks/workspace-file-manager.mock.ts
@@ -128,6 +128,9 @@ export const workspaceFileManagerMockFns = {
   mockUpdateWorkspaceFileDimensions: vi.fn(),
   mockGetWorkspaceFileByName: vi.fn(),
   mockListWorkspaceFiles: vi.fn(),
+  mockFindListedWorkspaceFiles: vi.fn(
+    async () => new Map<string, MockWorkspaceFileLookupFields | null>()
+  ),
   mockQueryWorkspaceFiles: vi.fn(),
   mockWorkspaceFileVfsPath: vi.fn(vfsPath),
   mockGetSandboxWorkspaceFilePath: vi.fn(
@@ -199,6 +202,7 @@ export const workspaceFileManagerMock = {
   updateWorkspaceFileDimensions: fns.mockUpdateWorkspaceFileDimensions,
   getWorkspaceFileByName: fns.mockGetWorkspaceFileByName,
   listWorkspaceFiles: fns.mockListWorkspaceFiles,
+  findListedWorkspaceFiles: fns.mockFindListedWorkspaceFiles,
   queryWorkspaceFiles: fns.mockQueryWorkspaceFiles,
   workspaceFileVfsPath: fns.mockWorkspaceFileVfsPath,
   getSandboxWorkspaceFilePath: fns.mockGetSandboxWorkspaceFilePath,
diff --git a/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts b/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
index e0b48379187..cfe90e177e4 100644
--- a/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
+++ b/packages/testing/src/mocks/workspace-file-secret-provenance.mock.ts
@@ -96,10 +96,12 @@ export const workspaceFileSecretProvenanceMockFns = {
   mockMarkWorkspaceFileSecretProvenanceUnknown: vi.fn(),
   mockGetBoundWorkspaceFileSecretProvenance: vi.fn(),
   mockGetBoundWorkspaceFileSecretProvenanceByMetadata: vi.fn(),
+  mockGetBoundWorkspaceFileSecretProvenanceByIdentity: vi.fn(),
+  mockGetCurrentWorkspaceFileSecretProvenance: vi.fn(),
+  mockGetStoredFileSecretProvenanceByKey: vi.fn(),
   mockImportWorkspaceFileSecretProvenanceForModelView: vi.fn(),
   mockIsOpaqueWorkspaceFileEgressSafe: vi.fn(),
   mockImportWorkspaceFileSecretProvenanceForRuntime: vi.fn(),
-  mockImportWorkspaceFileSnapshotProvenance: vi.fn(),
   mockFilterModelSafeWorkspaceFileAttachments: vi.fn(),
   mockIsModelSafeWorkspaceFileKey: vi.fn(),
   mockAreModelSafeWorkspaceFileKeys: vi.fn(),
@@ -142,12 +144,15 @@ export const workspaceFileSecretProvenanceMock = {
   getBoundWorkspaceFileSecretProvenance: fns.mockGetBoundWorkspaceFileSecretProvenance,
   getBoundWorkspaceFileSecretProvenanceByMetadata:
     fns.mockGetBoundWorkspaceFileSecretProvenanceByMetadata,
+  getBoundWorkspaceFileSecretProvenanceByIdentity:
+    fns.mockGetBoundWorkspaceFileSecretProvenanceByIdentity,
+  getCurrentWorkspaceFileSecretProvenance: fns.mockGetCurrentWorkspaceFileSecretProvenance,
+  getStoredFileSecretProvenanceByKey: fns.mockGetStoredFileSecretProvenanceByKey,
   importWorkspaceFileSecretProvenanceForModelView:
     fns.mockImportWorkspaceFileSecretProvenanceForModelView,
   isOpaqueWorkspaceFileEgressSafe: fns.mockIsOpaqueWorkspaceFileEgressSafe,
   importWorkspaceFileSecretProvenanceForRuntime:
     fns.mockImportWorkspaceFileSecretProvenanceForRuntime,
-  importWorkspaceFileSnapshotProvenance: fns.mockImportWorkspaceFileSnapshotProvenance,
   filterModelSafeWorkspaceFileAttachments: fns.mockFilterModelSafeWorkspaceFileAttachments,
   isModelSafeWorkspaceFileKey: fns.mockIsModelSafeWorkspaceFileKey,
   areModelSafeWorkspaceFileKeys: fns.mockAreModelSafeWorkspaceFileKeys,
diff --git a/scripts/check-test-types.baseline.json b/scripts/check-test-types.baseline.json
index b54a1d20dfb..d02c47ddb80 100644
--- a/scripts/check-test-types.baseline.json
+++ b/scripts/check-test-types.baseline.json
@@ -994,9 +994,6 @@
   "apps/sim/lib/api/list-keyset-paging.test.ts": {
     "TS2554": 4
   },
-  "apps/sim/lib/api/server/routes/copilot-route-inventory.test.ts": {
-    "TS2322": 1
-  },
   "apps/sim/lib/api/server/routes/definition.test.ts": {
     "TS2741": 1
   },
@@ -1683,9 +1680,6 @@
   "apps/sim/lib/knowledge/application/slack-search/stop.test.ts": {
     "TS2352": 2
   },
-  "apps/sim/lib/knowledge/application/tags.test.ts": {
-    "TS2322": 2
-  },
   "apps/sim/lib/knowledge/chunks/keyset-sql.test.ts": {
     "TS2345": 2
   },
@@ -1967,10 +1961,6 @@
     "TS2345": 1,
     "TS2550": 2
   },
-  "apps/sim/lib/mothership/chat/process-contents.test.ts": {
-    "TS2322": 6,
-    "TS2345": 1
-  },
   "apps/sim/lib/mothership/chat/terminal-state.test.ts": {
     "TS18046": 2,
     "TS2571": 1
@@ -2167,10 +2157,7 @@
   },
   "apps/sim/lib/table/application/rows.test.ts": {
     "TS2322": 4,
-    "TS2345": 1,
-    "TS2352": 1,
     "TS2353": 2,
-    "TS2493": 1,
     "TS2739": 5,
     "TS2741": 1
   },
@@ -2520,9 +2507,6 @@
   "apps/sim/lib/workspace-events/rules.test.ts": {
     "TS2353": 1
   },
-  "apps/sim/lib/workspace-files/application/download-workspace-file-items.test.ts": {
-    "TS2345": 1
-  },
   "apps/sim/lib/workspace-files/application/edit-workspace-file-content.test.ts": {
     "TS2345": 1,
     "TS2741": 1
diff --git a/scripts/check-unused-exports.baseline.json b/scripts/check-unused-exports.baseline.json
index b06798f4f11..0a790dc3e64 100644
--- a/scripts/check-unused-exports.baseline.json
+++ b/scripts/check-unused-exports.baseline.json
@@ -4405,8 +4405,6 @@
   "apps/sim/lib/execution/code-placeholders/javascript.ts#DirectEnvironmentRead",
   "apps/sim/lib/execution/constants.ts#BINARY_DOC_TASKS",
   "apps/sim/lib/execution/constants.ts#MAX_DOCUMENT_PREVIEW_CODE_BYTES",
-  "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceRefusalCause",
-  "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceSurface",
   "apps/sim/lib/execution/durable-secret-provenance-telemetry.ts#DurableSecretProvenanceWriteCause",
   "apps/sim/lib/execution/execution-signal.ts#ExecutionSignalHandler",
   "apps/sim/lib/execution/files.ts#processExecutionFile",
@@ -5282,7 +5280,6 @@
   "apps/sim/lib/workspace-events/constants.ts#SIM_RULE_EVENT_TYPES",
   "apps/sim/lib/workspace-files/application/csv-preview-workspace-file.ts#CsvPreviewWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/delete-workspace-file.ts#DeleteWorkspaceFileInput",
-  "apps/sim/lib/workspace-files/application/download-workspace-file-items.ts#MAX_ZIP_DOWNLOAD_BYTES",
   "apps/sim/lib/workspace-files/application/download-workspace-file.ts#DownloadWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/extract-workspace-file.ts#ExtractWorkspaceFileInput",
   "apps/sim/lib/workspace-files/application/extract-workspace-file.ts#ExtractWorkspaceFileResult",