From 4b5d90a55abb21769a049279af82313d03b2dded Mon Sep 17 00:00:00 2001
From: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Date: Tue, 21 Jul 2026 23:31:11 -0700
Subject: [PATCH 1/2] Add settings authorization acceptance contracts

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../settings/components/api-keys/api-keys.tsx |   8 +-
 .../components/byok/byok-key-manager.tsx      |   1 +
 .../recently-deleted/recently-deleted.tsx     |   1 +
 .../secrets-manager/secrets-manager.tsx       |  11 +-
 .../settings-resource-row.tsx                 |   9 +-
 .../settings-section/settings-section.tsx     |   2 +-
 .../team-management/team-management.tsx       |  78 +-
 .../settings-sidebar/settings-sidebar.tsx     |   7 +-
 apps/sim/e2e/README.md                        |  48 +-
 apps/sim/e2e/fakes/stripe/server.ts           |  53 +
 apps/sim/e2e/foundation/safety.spec.ts        |  13 +
 apps/sim/e2e/foundation/stripe-fake.spec.ts   |  43 +-
 apps/sim/e2e/scripts/options.ts               |   2 +
 .../e2e/settings/authorization/access.spec.ts | 238 +++++
 .../authorization/contract-integrity.spec.ts  | 317 ++++++
 .../e2e/settings/authorization/contracts.ts   | 960 ++++++++++++++++++
 .../authorization/mutation-controls.spec.ts   | 207 ++++
 .../authorization/unsaved-changes.spec.ts     | 153 +++
 apps/sim/e2e/settings/navigation/contracts.ts |   7 +-
 .../e2e/settings/persona-contracts.spec.ts    |  16 -
 apps/sim/e2e/support/deployment-profile.ts    |   2 +
 apps/sim/ee/components/setting-row.tsx        |  13 +-
 .../components/whitelabeling-settings.tsx     |   2 +
 apps/sim/playwright.config.ts                 |   8 +-
 24 files changed, 2122 insertions(+), 77 deletions(-)
 create mode 100644 apps/sim/e2e/settings/authorization/access.spec.ts
 create mode 100644 apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
 create mode 100644 apps/sim/e2e/settings/authorization/contracts.ts
 create mode 100644 apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
 create mode 100644 apps/sim/e2e/settings/authorization/unsaved-changes.spec.ts

diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/api-keys/api-keys.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/api-keys/api-keys.tsx
index d434f922ce2..f6b74fa033f 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/api-keys/api-keys.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/api-keys/api-keys.tsx
@@ -318,7 +318,12 @@ export function ApiKeys({ scope = 'workspace' }: ApiKeysProps) {
             <SettingsSection label='Permissions'>
               <div className='flex items-center justify-between'>
                 <div className='flex items-center gap-2'>
-                  <span className='text-[var(--text-body)] text-sm'>Allow personal API keys</span>
+                  <label
+                    htmlFor='allow-personal-api-keys'
+                    className='text-[var(--text-body)] text-sm'
+                  >
+                    Allow personal API keys
+                  </label>
                   <Tooltip.Root>
                     <Tooltip.Trigger asChild>
                       <button
@@ -337,6 +342,7 @@ export function ApiKeys({ scope = 'workspace' }: ApiKeysProps) {
                 </div>
                 {isLoadingSettings ? null : (
                   <Switch
+                    id='allow-personal-api-keys'
                     checked={allowPersonalApiKeys}
                     disabled={!canManageWorkspaceKeys || updateSettingsMutation.isPending}
                     onCheckedChange={async (checked) => {
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok-key-manager.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok-key-manager.tsx
index bc1c0b2d394..f4eb9c124c9 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok-key-manager.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok-key-manager.tsx
@@ -287,6 +287,7 @@ export function BYOKKeyManager(props: BYOKKeyManagerProps) {
     return (
       <SettingsResourceRow
         key={provider.id}
+        ariaLabel={provider.name}
         icon={<Icon />}
         title={provider.name}
         description={provider.description}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
index fc335655055..7738696eb84 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/recently-deleted/recently-deleted.tsx
@@ -423,6 +423,7 @@ export function RecentlyDeleted() {
             return (
               <SettingsResourceRow
                 key={resource.id}
+                ariaLabel={resource.name}
                 icon={<ResourceIcon resource={resource} />}
                 title={resource.name}
                 description={
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/secrets/components/secrets-manager/secrets-manager.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/secrets/components/secrets-manager/secrets-manager.tsx
index 3e18f61ff1e..fd30b72c435 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/secrets/components/secrets-manager/secrets-manager.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/secrets/components/secrets-manager/secrets-manager.tsx
@@ -271,6 +271,7 @@ function NewWorkspaceVariableRow({
   return (
     <div className='contents'>
       <ChipInput
+        aria-label='New workspace secret name'
         data-input-type='key'
         error={Boolean(keyError)}
         value={envVar.key}
@@ -286,6 +287,7 @@ function NewWorkspaceVariableRow({
       />
       <div />
       <SecretValueField
+        aria-label='New workspace secret value'
         data-input-type='value'
         value={envVar.value}
         onChange={(next) => onUpdate(index, 'value', next)}
@@ -982,8 +984,13 @@ export function SecretsManager() {
             {(!searchTerm.trim() ||
               filteredWorkspaceEntries.length > 0 ||
               filteredNewWorkspaceRows.length > 0) && (
-              <section className='flex flex-col'>
-                <span className='pl-0.5 text-[var(--text-muted)] text-small'>Workspace</span>
+              <section aria-labelledby='workspace-secrets-section' className='flex flex-col'>
+                <span
+                  id='workspace-secrets-section'
+                  className='pl-0.5 text-[var(--text-muted)] text-small'
+                >
+                  Workspace
+                </span>
                 <div className='mt-[9px] mb-3 h-px bg-[var(--border)]' />
                 <div className={`${GRID_COLS} gap-y-2`}>
                   {(searchTerm.trim()
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-resource-row/settings-resource-row.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-resource-row/settings-resource-row.tsx
index 88d9365e65a..c569601b860 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-resource-row/settings-resource-row.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-resource-row/settings-resource-row.tsx
@@ -12,6 +12,8 @@ import { cn } from '@sim/emcn'
  * contains to 20px, so callers pass their raw icon node without pre-sizing it.
  */
 interface SettingsResourceRowProps {
+  /** Optional accessible name for consumers that need to scope actions to this row. */
+  ariaLabel?: string
   /** Icon node centered in the tile; a `<svg>` is normalized to 20px, an `<img>` to 20px (or the full tile when `iconFill`). */
   icon: ReactNode
   /**
@@ -32,6 +34,7 @@ const TILE_BASE =
   'flex size-9 flex-shrink-0 items-center justify-center overflow-hidden rounded-xl border border-[var(--border-1)] bg-[var(--bg)] [&_svg]:size-5'
 
 export function SettingsResourceRow({
+  ariaLabel,
   icon,
   iconFill = false,
   title,
@@ -39,7 +42,11 @@ export function SettingsResourceRow({
   trailing,
 }: SettingsResourceRowProps) {
   return (
-    <div className='flex items-center justify-between gap-2.5'>
+    <div
+      role={ariaLabel ? 'group' : undefined}
+      aria-label={ariaLabel}
+      className='flex items-center justify-between gap-2.5'
+    >
       <div className='flex min-w-0 items-center gap-2.5'>
         <div className={cn(TILE_BASE, iconFill ? '[&_img]:size-full' : '[&_img]:size-5')}>
           {icon}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-section/settings-section.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-section/settings-section.tsx
index 18fa43c9315..57c06516b28 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/settings-section/settings-section.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/settings-section/settings-section.tsx
@@ -20,7 +20,7 @@ export function SettingsSection({
   children,
 }: SettingsSectionProps) {
   return (
-    <section className='flex flex-col'>
+    <section aria-label={label} className='flex flex-col'>
       <div className='flex items-center gap-1.5 pl-0.5'>
         <span className='text-[var(--text-muted)] text-small'>{label}</span>
         {headerAccessory}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
index 1f43f1cc594..c743d61156b 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
@@ -38,7 +38,7 @@ export function TeamManagement({
   organizationId,
   billingHref = `/organization/${organizationId}/settings/billing`,
 }: TeamManagementProps) {
-  const { data: session } = useSession()
+  const { data: session, isPending: isSessionPending } = useSession()
   const { isInvitationsDisabled } = usePermissionConfig()
 
   const { data: userSubscriptionData } = useSubscriptionData()
@@ -306,43 +306,49 @@ export function TeamManagement({
 
   return (
     <>
-      <SettingsPanel
-        actions={
-          adminOrOwner
-            ? [
-                {
-                  text: 'Invite',
-                  icon: Plus,
-                  variant: 'primary',
-                  onSelect: () => setInviteModalOpen(true),
-                  disabled: isInvitationsDisabled,
-                  tooltip: isInvitationsDisabled ? 'Invitations are disabled' : undefined,
-                },
-              ]
-            : []
-        }
+      <section
+        aria-label='Organization members'
+        aria-busy={isSessionPending || isLoading || isLoadingRoster}
+        className='flex flex-col gap-7'
       >
-        {adminOrOwner && (
-          <TeamSeatsOverview
-            billingHref={billingHref}
-            subscriptionData={orgSubscription}
-            isLoadingSubscription={isOrgBillingLoading}
-            totalSeats={totalSeats}
-            usedSeats={usedSeats}
-            pendingSeats={pendingSeats}
+        <SettingsPanel
+          actions={
+            adminOrOwner
+              ? [
+                  {
+                    text: 'Invite',
+                    icon: Plus,
+                    variant: 'primary',
+                    onSelect: () => setInviteModalOpen(true),
+                    disabled: isInvitationsDisabled,
+                    tooltip: isInvitationsDisabled ? 'Invitations are disabled' : undefined,
+                  },
+                ]
+              : []
+          }
+        >
+          {adminOrOwner && (
+            <TeamSeatsOverview
+              billingHref={billingHref}
+              subscriptionData={orgSubscription}
+              isLoadingSubscription={isOrgBillingLoading}
+              totalSeats={totalSeats}
+              usedSeats={usedSeats}
+              pendingSeats={pendingSeats}
+            />
+          )}
+
+          <OrganizationMemberLists
+            canManage={adminOrOwner}
+            organizationId={displayOrganization.id}
+            roster={roster ?? null}
+            isLoadingRoster={isLoadingRoster}
+            currentUserId={session?.user?.id ?? ''}
+            onRemoveMember={handleRemoveMember}
+            onTransferOwnership={handleOpenTransferDialog}
           />
-        )}
-
-        <OrganizationMemberLists
-          canManage={adminOrOwner}
-          organizationId={displayOrganization.id}
-          roster={roster ?? null}
-          isLoadingRoster={isLoadingRoster}
-          currentUserId={session?.user?.id ?? ''}
-          onRemoveMember={handleRemoveMember}
-          onTransferOwnership={handleOpenTransferDialog}
-        />
-      </SettingsPanel>
+        </SettingsPanel>
+      </section>
 
       {adminOrOwner && (
         <OrganizationInviteModal
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
index 0d8669e6fb1..04c72a5e9ff 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
@@ -10,7 +10,7 @@ import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { canManageWorkspaceBilling } from '@/lib/billing/workspace-permissions'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
-import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
+import { useWorkspacePermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import type { SettingsSection } from '@/app/workspace/[workspaceId]/settings/navigation'
 import {
   allNavigationItems,
@@ -73,7 +73,9 @@ export function SettingsSidebar({
 
   const { config: permissionConfig } = usePermissionConfig()
   const forkingAvailable = useForkingAvailable(workspaceId)
-  const { canAdmin: canAdminWorkspace } = useUserPermissionsContext()
+  const { userPermissions } = useWorkspacePermissionsContext()
+  const { canAdmin: canAdminWorkspace } = userPermissions
+  const permissionsReadinessBusy = userPermissions.isLoading || !userPermissions.canRead
 
   const userId = session?.user?.id
 
@@ -288,6 +290,7 @@ export function SettingsSidebar({
       <div
         role='navigation'
         aria-label='Workspace settings sections'
+        aria-busy={permissionsReadinessBusy}
         ref={isCollapsed ? undefined : scrollContainerRef}
         className={cn(
           'flex flex-1 flex-col overflow-y-auto overflow-x-hidden border-t pt-1.5 transition-colors duration-150',
diff --git a/apps/sim/e2e/README.md b/apps/sim/e2e/README.md
index 78b8f68129c..42db99e3eae 100644
--- a/apps/sim/e2e/README.md
+++ b/apps/sim/e2e/README.md
@@ -80,9 +80,9 @@ bun run test:e2e -- --grep "unauthenticated"
 ```
 
 Projects form a dependency chain to keep shared boundaries serialized. Selecting
-the personas project therefore also runs navigation and workflows by default,
-and an upstream failure skips its dependents. For focused local iteration,
-`--no-deps` is explicitly supported:
+the personas project therefore also runs navigation, authorization, and
+workflows by default, and an upstream failure skips its dependents. For focused
+local iteration, `--no-deps` is explicitly supported:
 
 ```bash
 bun run test:e2e -- --project=hosted-billing-chromium-personas --no-deps
@@ -131,6 +131,40 @@ That override fails closed unless the exact hosted E2E profile, E2E auth origin,
 and loopback `sim_e2e_*` database are all present; normal deployments retain
 Better Auth's defaults.
 
+## Settings authorization contracts
+
+Step 4 owns literal direct-route access, entitlement, and mutation-control
+datasets in `e2e/settings/authorization/contracts.ts`. Existing Step 3
+navigation positives are referenced by stable contract IDs instead of rerun.
+The browser specs cover the remaining account, organization, and workspace
+denials, paid Billing readiness, role-scoped mutation chrome, and shared
+unsaved-change behavior.
+
+Run only these contracts during local iteration:
+
+```bash
+bun run test:e2e -- --reuse-build \
+  --project=hosted-billing-chromium-authorization --no-deps \
+  e2e/settings/authorization
+```
+
+The hosted profile enables Custom blocks with `DEPLOY_AS_BLOCK=true` only for
+the Next.js build and app processes; migration, seed, auth capture, Playwright,
+and realtime never receive the flag. The strict Stripe fake implements only the
+invoice-list shape used by paid settings pages: an existing fake customer,
+`limit=20`, `expand[0]=data.lines`, and an optional cursor. It returns an empty
+Stripe list and rejects all extra or malformed request shapes.
+
+Unsaved-change coverage intentionally stops at settings sidebar navigation,
+the app's Settings Back action, and native `beforeunload`. Toolbar history and
+credential, fork, or custom-block detail guards belong to later roadmap steps.
+On the Step 4 reference run, two workers completed all 84 retry-free
+authorization tests in 1.2 minutes and the cache-hit orchestrator in 4 minutes
+42 seconds. The final dependency chain passed all 223 navigation,
+authorization, workflow, persona, and isolation tests in 2.4 minutes of
+Playwright time; the clean-build orchestrator completed in 8 minutes 25
+seconds.
+
 The cache lives under ignored `e2e/.cache/builds/`. A hit requires matching
 source contents (including uncommitted/untracked files), build/public profile,
 Node/Bun/Next versions, platform, `BUILD_ID`, and the cached artifact checksum.
@@ -153,10 +187,10 @@ were not launched by the orchestrator. Report and trace viewer commands remain
 safe because they do not execute tests.
 
 Sharding is supported only for the navigation project. The runner rejects
-`--shard` for workflows, persona contracts, and the dedicated two-worker
-cross-world isolation project. Project dependencies serialize navigation,
-workflows, and persona contracts before the isolation project opens its
-two-worker pool.
+`--shard` for authorization, workflows, persona contracts, and the dedicated
+two-worker cross-world isolation project. Project dependencies serialize
+navigation, authorization, workflows, and persona contracts before the
+isolation project opens its two-worker pool.
 
 ## Diagnostics
 
diff --git a/apps/sim/e2e/fakes/stripe/server.ts b/apps/sim/e2e/fakes/stripe/server.ts
index 9fe5d07826c..b5541897483 100644
--- a/apps/sim/e2e/fakes/stripe/server.ts
+++ b/apps/sim/e2e/fakes/stripe/server.ts
@@ -65,6 +65,7 @@ function isExpectedStripeRequest(method: string, path: string): boolean {
     ((method === 'GET' || method === 'POST') && path === '/v1/customers/search') ||
     (method === 'GET' && path === '/v1/customers') ||
     (method === 'POST' && path === '/v1/customers') ||
+    (method === 'GET' && path === '/v1/invoices') ||
     (method === 'POST' && path === STRIPE_FAKE_ENDPOINTS.telemetry) ||
     (method === 'GET' && /^\/v1\/customers\/cus_e2e_[a-f0-9]+$/.test(path))
   )
@@ -196,6 +197,42 @@ function parseLimit(parameters: URLSearchParams): number {
   return limit
 }
 
+function assertSupportedInvoiceList(
+  parameters: URLSearchParams,
+  customers: ReadonlyMap<string, FakeCustomer>
+): void {
+  const allowedKeys = new Set(['customer', 'limit', 'expand[0]', 'starting_after'])
+  for (const key of new Set(parameters.keys())) {
+    if (!allowedKeys.has(key)) {
+      throw new RequestBodyError(`Stripe fake does not implement invoice parameter: ${key}`, 501)
+    }
+  }
+
+  const customerValues = parameters.getAll('customer')
+  const limitValues = parameters.getAll('limit')
+  const expandValues = parameters.getAll('expand[0]')
+  const cursorValues = parameters.getAll('starting_after')
+  if (
+    customerValues.length !== 1 ||
+    limitValues.length !== 1 ||
+    expandValues.length !== 1 ||
+    cursorValues.length > 1
+  ) {
+    throw new RequestBodyError('Stripe fake requires one value for each invoice parameter', 501)
+  }
+
+  const customerId = customerValues[0]
+  if (!customerId || !customers.has(customerId)) {
+    throw new RequestBodyError(`Stripe fake does not know invoice customer: ${customerId}`, 501)
+  }
+  if (limitValues[0] !== '20' || expandValues[0] !== 'data.lines') {
+    throw new RequestBodyError('Stripe fake received an unsupported invoice list shape', 501)
+  }
+  if (cursorValues.length === 1 && !cursorValues[0]) {
+    throw new RequestBodyError('Stripe fake requires a non-empty invoice cursor', 501)
+  }
+}
+
 function validateTestApiKey(apiKey: string): void {
   if (!apiKey.startsWith('sk_test_') || apiKey.length === 'sk_test_'.length) {
     throw new Error('Stripe fake apiKey must be a non-empty sk_test_ secret key')
@@ -410,6 +447,22 @@ export function createStripeFakeServer(options: StripeFakeServerOptions): Stripe
         return
       }
 
+      if (method === 'GET' && url.pathname === '/v1/invoices') {
+        assertSupportedInvoiceList(url.searchParams, customers)
+        sendJson(
+          response,
+          200,
+          {
+            object: 'list',
+            data: [],
+            has_more: false,
+            url: '/v1/invoices',
+          },
+          requestId
+        )
+        return
+      }
+
       if (method === 'GET' && url.pathname.startsWith('/v1/customers/')) {
         const customerId = decodeURIComponent(url.pathname.slice('/v1/customers/'.length))
         const customer = customers.get(customerId)
diff --git a/apps/sim/e2e/foundation/safety.spec.ts b/apps/sim/e2e/foundation/safety.spec.ts
index b5ce3d3d45e..5d9fbeb5bb5 100644
--- a/apps/sim/e2e/foundation/safety.spec.ts
+++ b/apps/sim/e2e/foundation/safety.spec.ts
@@ -91,6 +91,8 @@ test.describe('foundation safety guards', () => {
     expect(build.env.TELEMETRY_ENDPOINT).toBe('http://127.0.0.1:1/v1/traces')
     expect(app.env.TELEMETRY_ENDPOINT).toMatch(/^http:\/\/127\.0\.0\.1:\d+\/v1\/traces$/)
     expect(build.env.E2E_RUN_ID).toBe('build_sentinel')
+    expect(build.env.DEPLOY_AS_BLOCK).toBe('true')
+    expect(app.env.DEPLOY_AS_BLOCK).toBe('true')
     for (const key of [
       'BETTER_AUTH_SECRET',
       'ENCRYPTION_KEY',
@@ -117,6 +119,9 @@ test.describe('foundation safety guards', () => {
     expect(realtime.env.STRIPE_SECRET_KEY).toBeUndefined()
     expect(migration.env.ADMIN_API_KEY).toBeUndefined()
     expect(migration.env.MIGRATION_DATABASE_URL).toBe(app.env.DATABASE_URL)
+    for (const environment of [realtime, migration, seed, authCapture, playwright]) {
+      expect(environment.env.DEPLOY_AS_BLOCK).toBeUndefined()
+    }
     expect(app.env.HOME).not.toBe(seed.env.HOME)
     expect(seed.env.HOME).not.toBe(authCapture.env.HOME)
     expect(authCapture.env.HOME).not.toBe(playwright.env.HOME)
@@ -176,6 +181,14 @@ test.describe('foundation safety guards', () => {
     expect(() =>
       parseRunOptions(['--project=hosted-billing-chromium-navigation', '--shard=1/2'])
     ).not.toThrow()
+    expect(() =>
+      parseRunOptions(['--project=hosted-billing-chromium-authorization', '--no-deps'], {
+        ci: false,
+      })
+    ).not.toThrow()
+    expect(() =>
+      parseRunOptions(['--project=hosted-billing-chromium-authorization', '--shard=1/2'])
+    ).toThrow(/coupled E2E projects must remain unsharded/)
     expect(() =>
       parseRunOptions(['--project=hosted-billing-chromium-workflows', '--shard=1/2'])
     ).toThrow(/coupled E2E projects must remain unsharded/)
diff --git a/apps/sim/e2e/foundation/stripe-fake.spec.ts b/apps/sim/e2e/foundation/stripe-fake.spec.ts
index 8a0b839164b..d51a98582fa 100644
--- a/apps/sim/e2e/foundation/stripe-fake.spec.ts
+++ b/apps/sim/e2e/foundation/stripe-fake.spec.ts
@@ -23,7 +23,8 @@ test('Stripe fake records allowlisted calls and rejects unknown routes', async (
       }),
     })
     expect(customer.status).toBe(200)
-    expect((await customer.json()) as { id: string }).toMatchObject({
+    const customerPayload = (await customer.json()) as { id: string }
+    expect(customerPayload).toMatchObject({
       id: expect.stringMatching(/^cus_e2e_/),
     })
 
@@ -36,6 +37,22 @@ test('Stripe fake records allowlisted calls and rejects unknown routes', async (
     )
     expect(search.status).toBe(200)
 
+    const invoices = await fetch(
+      `${baseUrl}/v1/invoices?${new URLSearchParams({
+        customer: customerPayload.id,
+        limit: '20',
+        'expand[0]': 'data.lines',
+      })}`,
+      { headers: { authorization: `Bearer ${apiKey}` } }
+    )
+    expect(invoices.status).toBe(200)
+    expect(await invoices.json()).toEqual({
+      object: 'list',
+      data: [],
+      has_more: false,
+      url: '/v1/invoices',
+    })
+
     const telemetry = await fetch(`${baseUrl}/v1/traces`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -56,11 +73,31 @@ test('Stripe fake records allowlisted calls and rejects unknown routes', async (
     )
     expect(unsupportedSearch.status).toBe(501)
 
-    const unknown = await fetch(`${baseUrl}/v1/invoices`, {
+    const unsupportedInvoices = await fetch(
+      `${baseUrl}/v1/invoices?${new URLSearchParams({
+        customer: customerPayload.id,
+        limit: '10',
+        'expand[0]': 'data.lines',
+      })}`,
+      { headers: { authorization: `Bearer ${apiKey}` } }
+    )
+    expect(unsupportedInvoices.status).toBe(501)
+    expect(
+      fake.requestLog.some(
+        ({ method, path, unexpected }) => method === 'GET' && path === '/v1/invoices' && unexpected
+      )
+    ).toBe(true)
+
+    const unknown = await fetch(`${baseUrl}/v1/payment_intents`, {
       headers: { authorization: `Bearer ${apiKey}` },
     })
     expect(unknown.status).toBe(501)
-    expect(fake.requestLog.some(({ unexpected }) => unexpected)).toBe(true)
+    expect(
+      fake.requestLog.some(
+        ({ method, path, unexpected }) =>
+          method === 'GET' && path === '/v1/payment_intents' && unexpected
+      )
+    ).toBe(true)
   } finally {
     await fake.stop()
   }
diff --git a/apps/sim/e2e/scripts/options.ts b/apps/sim/e2e/scripts/options.ts
index ae4dc26150d..5577a1aa97d 100644
--- a/apps/sim/e2e/scripts/options.ts
+++ b/apps/sim/e2e/scripts/options.ts
@@ -1,9 +1,11 @@
 const NAVIGATION_PROJECT = 'hosted-billing-chromium-navigation'
+const AUTHORIZATION_PROJECT = 'hosted-billing-chromium-authorization'
 const WORKFLOWS_PROJECT = 'hosted-billing-chromium-workflows'
 const PERSONAS_PROJECT = 'hosted-billing-chromium-personas'
 const PERSONA_ISOLATION_PROJECT = 'hosted-billing-chromium-persona-isolation'
 const E2E_PROJECTS = new Set([
   NAVIGATION_PROJECT,
+  AUTHORIZATION_PROJECT,
   WORKFLOWS_PROJECT,
   PERSONAS_PROJECT,
   PERSONA_ISOLATION_PROJECT,
diff --git a/apps/sim/e2e/settings/authorization/access.spec.ts b/apps/sim/e2e/settings/authorization/access.spec.ts
new file mode 100644
index 00000000000..08dbb9f0fe9
--- /dev/null
+++ b/apps/sim/e2e/settings/authorization/access.spec.ts
@@ -0,0 +1,238 @@
+import type { Page } from '@playwright/test'
+import { expect, test } from '../../fixtures/persona-test'
+import {
+  absoluteE2eUrl,
+  readinessLocator,
+  resolveBoundResourceId,
+  resolveContractPath,
+} from '../navigation/contract-resolver'
+import type { AccessGateCase } from './contracts'
+import { accessGateCases } from './contracts'
+
+for (const literalCase of accessGateCases) {
+  const accessCase: AccessGateCase = literalCase
+
+  test(`${accessCase.caseId} matches its authorization contract`, async ({
+    contextForPersona,
+    personaManifest,
+  }) => {
+    const context = await contextForPersona(accessCase.driver.personaKey)
+    const page = await context.newPage()
+
+    if (
+      accessCase.sidebar.state !== 'absent-shell' &&
+      accessCase.sidebar.existingProofId === undefined
+    ) {
+      await gotoAccessibleNeutral(page, accessCase, personaManifest)
+      await assertSidebarState(page, accessCase)
+    }
+
+    const targetPath = resolveContractPath(
+      personaManifest,
+      accessCase.pathTemplate,
+      accessCase.driver
+    )
+    const responseProof =
+      accessCase.outcome.kind === 'render' ? accessCase.outcome.successfulResponse : undefined
+    const proofPromise = responseProof
+      ? page.waitForResponse((response) => {
+          const responseUrl = new URL(response.url())
+          const baseUrl = new URL(absoluteE2eUrl('/'))
+          return (
+            responseUrl.origin === baseUrl.origin &&
+            responseUrl.pathname === responseProof.path &&
+            response.status() === 200
+          )
+        })
+      : null
+
+    const navigationResponse = await page.goto(absoluteE2eUrl(targetPath))
+    const proofResponse = proofPromise ? await proofPromise : null
+    if (proofResponse && responseProof?.expectedJson !== undefined) {
+      await expect(proofResponse.json()).resolves.toEqual(responseProof.expectedJson)
+    }
+
+    await expect(page).toHaveURL(absoluteE2eUrl(targetPath))
+    switch (accessCase.outcome.kind) {
+      case 'render': {
+        expect(navigationResponse?.ok(), `${accessCase.caseId} document response`).toBe(true)
+        await expect(
+          page.getByRole('heading', {
+            name: accessCase.outcome.heading,
+            level: 1,
+            exact: true,
+          })
+        ).toBeVisible()
+        const readiness = readinessLocator(page, accessCase.outcome.readiness)
+        await expect(readiness).toBeVisible()
+        if (accessCase.outcome.readinessState === 'enabled') await expect(readiness).toBeEnabled()
+        if (accessCase.outcome.readinessState === 'disabled') await expect(readiness).toBeDisabled()
+        break
+      }
+      case 'not-found':
+        expect(
+          navigationResponse?.status(),
+          `${accessCase.caseId} must use the real route 404 boundary`
+        ).toBe(404)
+        break
+      case 'workspace-access-denied':
+        await expect(
+          page.getByRole('heading', {
+            name: 'Workspace access denied',
+            level: 1,
+            exact: true,
+          })
+        ).toBeVisible()
+        await expect(
+          page.getByText(
+            'You do not have access to this workspace. Ask a workspace administrator for access or choose another workspace.',
+            { exact: true }
+          )
+        ).toBeVisible()
+        await expect(page.getByRole('complementary', { name: 'Workspace sidebar' })).toHaveCount(0)
+        break
+      case 'organization-unavailable':
+        expect(navigationResponse?.ok(), `${accessCase.caseId} embedded denial response`).toBe(true)
+        await expect(
+          page.getByRole('heading', {
+            name: accessCase.outcome.title,
+            level: 1,
+            exact: true,
+          })
+        ).toBeVisible()
+        await expect(
+          page.getByText(
+            'You do not have access to manage this organization. Contact an organization owner or admin for help.',
+            { exact: true }
+          )
+        ).toBeVisible()
+        await expect(
+          page.getByRole('complementary', {
+            name: 'Organization settings navigation',
+          })
+        ).toBeVisible()
+        break
+      case 'organization-plan-unavailable':
+        expect(navigationResponse?.ok(), `${accessCase.caseId} embedded denial response`).toBe(true)
+        await expect(
+          page.getByRole('heading', {
+            name: accessCase.outcome.title,
+            level: 1,
+            exact: true,
+          })
+        ).toBeVisible()
+        await expect(
+          page.getByText('This setting is not enabled for this organization.', { exact: true })
+        ).toBeVisible()
+        await expect(
+          page.getByRole('complementary', {
+            name: 'Organization settings navigation',
+          })
+        ).toBeVisible()
+        break
+      case 'locked-render': {
+        expect(navigationResponse?.ok(), `${accessCase.caseId} locked document response`).toBe(true)
+        await expect(
+          page.getByRole('heading', {
+            name: accessCase.outcome.heading,
+            level: accessCase.outcome.headingLevel ?? 1,
+            exact: true,
+          })
+        ).toBeVisible()
+        const readiness = readinessLocator(page, accessCase.outcome.readiness)
+        await expect(readiness).toBeVisible()
+        if (accessCase.outcome.readinessState === 'enabled') await expect(readiness).toBeEnabled()
+        if (accessCase.outcome.readinessState === 'disabled') await expect(readiness).toBeDisabled()
+        break
+      }
+    }
+  })
+}
+
+async function gotoAccessibleNeutral(
+  page: Page,
+  accessCase: AccessGateCase,
+  manifest: Parameters<typeof resolveContractPath>[0]
+): Promise<void> {
+  if (accessCase.plane === 'account') {
+    await page.goto(absoluteE2eUrl('/account/settings/general'))
+    await expect(
+      page.getByRole('complementary', { name: 'Account settings navigation' })
+    ).toBeVisible()
+    return
+  }
+
+  if (accessCase.plane === 'organization') {
+    const path = resolveContractPath(
+      manifest,
+      '/organization/{organizationId}/settings/members',
+      accessCase.driver
+    )
+    await page.goto(absoluteE2eUrl(path))
+    await expect(
+      page.getByRole('complementary', { name: 'Organization settings navigation' })
+    ).toBeVisible()
+    return
+  }
+
+  const binding = accessCase.driver.binding
+  if (!binding || binding.resourceKind !== 'workspace') {
+    throw new Error(`${accessCase.caseId} requires a workspace binding`)
+  }
+  const workspaceId = resolveBoundResourceId(manifest, binding)
+  const readiness = [
+    waitForSuccessfulPath(page, '/api/permission-groups/user'),
+    waitForSuccessfulPath(page, '/api/settings/allowed-integrations'),
+    waitForSuccessfulPath(page, `/api/workspaces/${encodeURIComponent(workspaceId)}/inbox`),
+    waitForSuccessfulPath(
+      page,
+      `/api/workspaces/${encodeURIComponent(workspaceId)}/fork/availability`
+    ),
+  ]
+  const path = resolveContractPath(
+    manifest,
+    '/workspace/{workspaceId}/settings/general',
+    accessCase.driver
+  )
+  await Promise.all([page.goto(absoluteE2eUrl(path)), ...readiness])
+  await expect(page.getByRole('complementary', { name: 'Workspace sidebar' })).toBeVisible()
+}
+
+async function assertSidebarState(page: Page, accessCase: AccessGateCase): Promise<void> {
+  const label = accessCase.sidebar.label
+  if (!label) throw new Error(`${accessCase.caseId} is missing its sidebar label`)
+
+  const sidebar = page.getByRole('complementary', {
+    name:
+      accessCase.plane === 'account'
+        ? 'Account settings navigation'
+        : accessCase.plane === 'organization'
+          ? 'Organization settings navigation'
+          : 'Workspace sidebar',
+  })
+  const navigation =
+    accessCase.plane === 'workspace'
+      ? sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
+      : sidebar
+  const item = navigation.getByRole('button', { name: label, exact: true })
+
+  if (accessCase.sidebar.state === 'hidden') {
+    await expect(item).toHaveCount(0)
+    return
+  }
+  await expect(item).toBeVisible()
+  if (accessCase.sidebar.state === 'locked') {
+    await expect(item.getByText('Max', { exact: true })).toBeVisible()
+  }
+}
+
+function waitForSuccessfulPath(page: Page, pathname: string) {
+  return page.waitForResponse((response) => {
+    const url = new URL(response.url())
+    return (
+      url.origin === new URL(absoluteE2eUrl('/')).origin &&
+      url.pathname === pathname &&
+      response.status() === 200
+    )
+  })
+}
diff --git a/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts b/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
new file mode 100644
index 00000000000..81469e54574
--- /dev/null
+++ b/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
@@ -0,0 +1,317 @@
+import { expect, test } from '@playwright/test'
+import {
+  type AuthenticatedDriver,
+  personaVisibilityCases,
+  routeCases,
+  sectionContracts,
+} from '../navigation/contracts'
+import { createSettingsPersonaScenarios, SETTINGS_PERSONA_KEYS } from '../personas'
+import { accessGateCases, existingNavigationProofs, mutationControlCases } from './contracts'
+
+const scenario = createSettingsPersonaScenarios('authorization-contract').primary
+const personas = new Map(scenario.personas.map((persona) => [persona.key, persona]))
+const workspaces = new Set(scenario.workspaces.map(({ key }) => key))
+const organizations = new Set(scenario.organizations.map(({ key }) => key))
+
+test('authorization contracts have stable unique identities and semantic probes', () => {
+  expectUnique(
+    accessGateCases.map(({ caseId }) => caseId),
+    'access caseId'
+  )
+  expectUnique(
+    mutationControlCases.map(({ caseId }) => caseId),
+    'mutation caseId'
+  )
+  expectUnique(
+    existingNavigationProofs.map(({ proofId }) => proofId),
+    'existing proofId'
+  )
+
+  for (const accessCase of accessGateCases) {
+    expect(accessCase.outcome.kind, `${accessCase.caseId} outcome`).toBeTruthy()
+    assertCanonicalPath(accessCase.pathTemplate, accessCase.plane, accessCase.caseId)
+    assertScenarioBinding(accessCase.driver, accessCase.caseId, accessCase.outcome.kind)
+    if (accessCase.sidebar.existingProofId) {
+      expect(
+        existingNavigationProofs.some(
+          ({ proofId }) => proofId === accessCase.sidebar.existingProofId
+        ),
+        `${accessCase.caseId} sidebar proof`
+      ).toBe(true)
+    } else if (accessCase.sidebar.state !== 'absent-shell') {
+      expect(accessCase.sidebar.label, `${accessCase.caseId} sidebar label`).toBeTruthy()
+    }
+    if (accessCase.outcome.kind === 'render') {
+      expect(accessCase.outcome.readiness, `${accessCase.caseId} readiness`).toBeTruthy()
+      expect(accessCase.outcome.heading, `${accessCase.caseId} heading`).not.toBe('')
+    }
+    if (accessCase.outcome.kind === 'locked-render') {
+      expect(accessCase.sidebar.state, accessCase.caseId).toBe('locked')
+      expect(accessCase.outcome.readiness, `${accessCase.caseId} locked readiness`).toBeTruthy()
+    }
+  }
+
+  for (const mutationCase of mutationControlCases) {
+    assertCanonicalPath(
+      mutationCase.pathTemplate,
+      planeForPath(mutationCase.pathTemplate),
+      mutationCase.caseId
+    )
+    assertScenarioBinding(mutationCase.driver, mutationCase.caseId, 'render')
+    expect(mutationCase.readiness, `${mutationCase.caseId} readiness`).toBeTruthy()
+    expect(mutationCase.controls.length, `${mutationCase.caseId} controls`).toBeGreaterThan(0)
+    expectUnique(
+      mutationCase.controls.map(({ probeId }) => probeId),
+      `${mutationCase.caseId} probeId`
+    )
+    if (mutationCase.openDialogWith) {
+      expect(
+        mutationCase.controls.some(({ scope }) => scope.kind === 'dialog'),
+        `${mutationCase.caseId} dialog-scoped probe`
+      ).toBe(true)
+    }
+    for (const probe of mutationCase.controls) {
+      expect(probe.control.name, `${mutationCase.caseId}/${probe.probeId} control name`).not.toBe(
+        ''
+      )
+      expect(
+        ['enabled', 'disabled', 'absent', 'present'],
+        `${mutationCase.caseId}/${probe.probeId} expectation`
+      ).toContain(probe.expectation)
+    }
+  }
+})
+
+test('Step 3 proof references resolve without rerunning their cases', () => {
+  const referenceIds = {
+    'section-contract': new Set<string>(sectionContracts.map(({ contractId }) => contractId)),
+    'route-case': new Set<string>(routeCases.map(({ caseId }) => caseId)),
+    'visibility-case': new Set<string>(personaVisibilityCases.map(({ caseId }) => caseId)),
+  }
+
+  for (const proof of existingNavigationProofs) {
+    expect(referenceIds[proof.source].has(proof.referenceId), proof.proofId).toBe(true)
+    expect(proof.owns, `${proof.proofId} ownership`).not.toBe('')
+  }
+
+  expect(existingNavigationProofs.map(({ proofId }) => proofId)).toEqual([
+    'step3-organization-non-member-boundary',
+    'step3-organization-member-billing-denial',
+    'step3-account-platform-admin-positive',
+    'step3-workspace-platform-admin-positive',
+    'step3-max-inbox-positive',
+    'step3-enterprise-organization-positive',
+    'step3-enterprise-workspace-positive',
+    'step3-permission-group-sidebar',
+  ])
+})
+
+test('access contracts declare every required Step 4 gate axis', () => {
+  expectSections(
+    accessGateCases.filter(({ caseId }) => caseId.startsWith('organization-read-member-')),
+    ['access-control', 'audit-logs', 'sso', 'data-retention', 'data-drains', 'whitelabeling']
+  )
+  expectSections(
+    accessGateCases.filter(
+      ({ caseId }) =>
+        caseId.startsWith('organization-lapsed-owner-') && caseId.endsWith('-plan-denied')
+    ),
+    ['access-control', 'audit-logs', 'sso', 'data-retention', 'data-drains', 'whitelabeling']
+  )
+  expectSections(
+    accessGateCases.filter(({ caseId }) => caseId.startsWith('workspace-member-')),
+    [
+      'organization',
+      'billing',
+      'access-control',
+      'audit-logs',
+      'sso',
+      'data-retention',
+      'data-drains',
+      'whitelabeling',
+    ]
+  )
+  expectSections(
+    accessGateCases.filter(({ caseId }) => caseId.startsWith('workspace-team-owner-')),
+    [
+      'access-control',
+      'audit-logs',
+      'sso',
+      'data-retention',
+      'data-drains',
+      'whitelabeling',
+      'forks',
+      'custom-blocks',
+    ]
+  )
+  expectSections(
+    accessGateCases.filter(({ caseId }) => caseId.startsWith('workspace-permission-group-')),
+    ['secrets', 'apikeys', 'inbox', 'mcp', 'custom-tools']
+  )
+
+  for (const requiredId of [
+    'account-personal-paid-billing',
+    'account-non-platform-admin-denied',
+    'account-non-platform-mothership-denied',
+    'organization-lapsed-owner-members',
+    'organization-lapsed-owner-billing',
+    'organization-team-owner-billing',
+    'workspace-foreign-access-denied',
+    'workspace-external-admin-organization-denied',
+    'workspace-external-admin-billing-denied',
+    'workspace-enterprise-billing',
+    'workspace-personal-paid-inbox-locked',
+    'workspace-personal-paid-billing',
+    'workspace-non-platform-admin-denied',
+    'workspace-non-platform-mothership-denied',
+  ]) {
+    expect(
+      accessGateCases.some(({ caseId }) => caseId === requiredId),
+      requiredId
+    ).toBe(true)
+  }
+})
+
+test('mutation contracts declare every required section and role boundary', () => {
+  const requiredWorkspaceSections = [
+    'secrets',
+    'custom-tools',
+    'mcp',
+    'workflow-mcp-servers',
+    'teammates',
+    'byok',
+    'recently-deleted',
+    'apikeys',
+    'inbox',
+    'forks',
+    'custom-blocks',
+  ]
+  const workspaceSections = new Set(
+    mutationControlCases
+      .filter(({ pathTemplate }) => pathTemplate.startsWith('/workspace/'))
+      .map(({ pathTemplate }) => pathTemplate.split('/').at(-1))
+  )
+  for (const section of requiredWorkspaceSections) {
+    expect(workspaceSections.has(section), `workspace mutation section ${section}`).toBe(true)
+  }
+
+  for (const section of [
+    'secrets',
+    'custom-tools',
+    'mcp',
+    'workflow-mcp-servers',
+    'teammates',
+    'byok',
+    'recently-deleted',
+    'apikeys',
+  ]) {
+    const personas = mutationControlCases
+      .filter(({ pathTemplate }) => pathTemplate.endsWith(`/settings/${section}`))
+      .map(({ driver }) => driver.personaKey)
+    expect(new Set(personas), `${section} read/write/admin matrix`).toEqual(
+      new Set(['workspaceReadMember', 'workspaceWriteMember', 'workspaceAdminMember'])
+    )
+  }
+
+  expect(
+    mutationControlCases.some(
+      ({ caseId, pathTemplate }) =>
+        caseId === 'organization-member-members-controls' &&
+        pathTemplate.endsWith('/settings/members')
+    )
+  ).toBe(true)
+  expect(
+    mutationControlCases.some(
+      ({ caseId, pathTemplate }) =>
+        caseId === 'organization-enterprise-access-control-create' &&
+        pathTemplate.endsWith('/settings/access-control')
+    )
+  ).toBe(true)
+})
+
+test('Step 4 paths stay canonical and separate from Step 3 special paths', () => {
+  const paths = [
+    ...accessGateCases.map(({ pathTemplate }) => pathTemplate),
+    ...mutationControlCases.map(({ pathTemplate }) => pathTemplate),
+  ]
+  for (const path of paths) {
+    expect(path, 'workspace API-key alias belongs to Step 3').not.toMatch(
+      /^\/workspace\/\{workspaceId\}\/settings\/api-keys$/
+    )
+    expect(path, 'base settings redirects belong to Step 3').not.toMatch(/\/settings$/)
+    expect(path, 'unknown sections belong to Step 3').not.toContain('not-a-section')
+    expect(path, 'integration redirect belongs to Step 3').not.toContain('/settings/integrations')
+    expect(path, 'skills redirect belongs to Step 3').not.toContain('/settings/skills')
+  }
+})
+
+function assertCanonicalPath(pathTemplate: string, plane: string, label: string): void {
+  expect(pathTemplate.startsWith('/'), `${label} absolute path`).toBe(true)
+  expect(pathTemplate.includes('?'), `${label} path without query`).toBe(false)
+  if (plane === 'account') {
+    expect(pathTemplate, `${label} account path`).toMatch(/^\/account\/settings\/[a-z-]+$/)
+  } else {
+    expect(pathTemplate, `${label} dynamic ${plane} path`).toMatch(
+      new RegExp(`^/${plane}/\\{${plane}Id\\}/settings/[a-z-]+$`)
+    )
+  }
+}
+
+function assertScenarioBinding(
+  driver: AuthenticatedDriver,
+  label: string,
+  outcomeKind: string
+): void {
+  expect(
+    new Set<string>(SETTINGS_PERSONA_KEYS).has(driver.personaKey),
+    `${label} persona key`
+  ).toBe(true)
+  const persona = personas.get(driver.personaKey)
+  expect(persona, `${label} persona`).toBeTruthy()
+  if (!driver.binding) return
+
+  expect(driver.binding.worldKey, `${label} world`).toBe('settings-primary')
+  if (driver.binding.resourceKind === 'workspace') {
+    expect(workspaces.has(driver.binding.resourceKey), `${label} workspace`).toBe(true)
+    const expectation = persona?.workspaces.find(
+      ({ workspaceKey }) => workspaceKey === driver.binding?.resourceKey
+    )
+    expect(expectation, `${label} persona workspace binding`).toBeTruthy()
+    if (outcomeKind === 'workspace-access-denied') {
+      expect(expectation?.access, `${label} denied workspace access`).toBe('none')
+    } else {
+      expect(expectation?.access, `${label} accessible workspace`).not.toBe('none')
+    }
+    return
+  }
+
+  expect(organizations.has(driver.binding.resourceKey), `${label} organization`).toBe(true)
+  expect(
+    scenario.organizationMemberships.some(
+      ({ organizationKey, userKey }) =>
+        organizationKey === driver.binding?.resourceKey && userKey === persona?.userKey
+    ),
+    `${label} organization membership`
+  ).toBe(true)
+}
+
+function expectSections(
+  cases: readonly { pathTemplate: string }[],
+  expectedSections: readonly string[]
+): void {
+  expect(
+    cases.map(({ pathTemplate }) => pathTemplate.split('/').at(-1)),
+    'literal section coverage'
+  ).toEqual(expectedSections)
+}
+
+function planeForPath(pathTemplate: string): 'account' | 'organization' | 'workspace' {
+  if (pathTemplate.startsWith('/account/')) return 'account'
+  if (pathTemplate.startsWith('/organization/')) return 'organization'
+  return 'workspace'
+}
+
+function expectUnique(values: readonly string[], label: string): void {
+  const duplicates = values.filter((value, index) => values.indexOf(value) !== index)
+  expect(duplicates, `duplicate ${label}`).toEqual([])
+}
diff --git a/apps/sim/e2e/settings/authorization/contracts.ts b/apps/sim/e2e/settings/authorization/contracts.ts
new file mode 100644
index 00000000000..453f34b6a13
--- /dev/null
+++ b/apps/sim/e2e/settings/authorization/contracts.ts
@@ -0,0 +1,960 @@
+import type {
+  AuthenticatedDriver,
+  SemanticReadiness,
+  SettingsPlane,
+  SuccessfulResponse,
+} from '../navigation/contracts'
+
+export type SidebarState = 'visible' | 'hidden' | 'locked' | 'absent-shell'
+
+export interface SidebarExpectation {
+  state: SidebarState
+  label?: string
+  existingProofId?: string
+}
+
+export type AccessOutcome =
+  | {
+      kind: 'render'
+      heading: string
+      readiness: SemanticReadiness
+      readinessState?: 'enabled' | 'disabled'
+      successfulResponse?: SuccessfulResponse
+    }
+  | { kind: 'not-found' }
+  | { kind: 'workspace-access-denied' }
+  | { kind: 'organization-unavailable'; title: 'Settings unavailable' }
+  | { kind: 'organization-plan-unavailable'; title: 'Setting unavailable' }
+  | {
+      kind: 'locked-render'
+      heading: string
+      headingLevel?: 1 | 3
+      readiness: SemanticReadiness
+      readinessState?: 'enabled' | 'disabled'
+    }
+
+export interface AccessGateCase {
+  caseId: string
+  plane: SettingsPlane
+  pathTemplate: string
+  driver: AuthenticatedDriver
+  sidebar: SidebarExpectation
+  outcome: AccessOutcome
+}
+
+export type AuthorizationReadiness = SemanticReadiness | { kind: 'text-pattern'; source: string }
+
+export type ControlExpectation = 'enabled' | 'disabled' | 'absent' | 'present'
+
+export type ControlScope =
+  | { kind: 'page' }
+  | { kind: 'dialog'; name: string }
+  | { kind: 'section'; name: string }
+  | { kind: 'row'; name: string }
+
+export type SemanticControl =
+  | { kind: 'button'; name: string }
+  | { kind: 'textbox'; name: string }
+  | { kind: 'switch'; name: string }
+  | { kind: 'radio'; name: string }
+
+export interface MutationControlProbe {
+  probeId: string
+  control: SemanticControl
+  scope: ControlScope
+  expectation: ControlExpectation
+}
+
+export interface MutationControlCase {
+  caseId: string
+  pathTemplate: string
+  driver: AuthenticatedDriver
+  readiness: AuthorizationReadiness
+  openDialogWith?: { kind: 'button'; name: string }
+  arrangement?: 'archived-workflow'
+  controls: readonly MutationControlProbe[]
+}
+
+export interface ExistingNavigationProof {
+  proofId: string
+  source: 'section-contract' | 'route-case' | 'visibility-case'
+  referenceId: string
+  owns: string
+}
+
+const invoiceResponse = {
+  path: '/api/billing/invoices',
+  expectedJson: { success: true, invoices: [], hasMore: false },
+} as const satisfies SuccessfulResponse
+
+export const existingNavigationProofs = [
+  {
+    proofId: 'step3-organization-non-member-boundary',
+    source: 'route-case',
+    referenceId: 'organization-non-member-layout-unavailable',
+    owns: 'non-member organization layout denial',
+  },
+  {
+    proofId: 'step3-organization-member-billing-denial',
+    source: 'route-case',
+    referenceId: 'organization-member-section-unavailable',
+    owns: 'organization member Billing denial',
+  },
+  {
+    proofId: 'step3-account-platform-admin-positive',
+    source: 'visibility-case',
+    referenceId: 'account-platform-admin',
+    owns: 'platform-admin account Admin and Mothership visibility',
+  },
+  {
+    proofId: 'step3-workspace-platform-admin-positive',
+    source: 'visibility-case',
+    referenceId: 'workspace-platform-admin',
+    owns: 'platform-admin workspace Admin and Mothership visibility',
+  },
+  {
+    proofId: 'step3-max-inbox-positive',
+    source: 'section-contract',
+    referenceId: 'workspace-inbox',
+    owns: 'Max workspace enabled Inbox render',
+  },
+  {
+    proofId: 'step3-enterprise-organization-positive',
+    source: 'visibility-case',
+    referenceId: 'organization-enterprise-admin',
+    owns: 'Enterprise organization canonical section visibility',
+  },
+  {
+    proofId: 'step3-enterprise-workspace-positive',
+    source: 'visibility-case',
+    referenceId: 'workspace-enterprise-admin',
+    owns: 'Enterprise workspace Organization and Enterprise section visibility',
+  },
+  {
+    proofId: 'step3-permission-group-sidebar',
+    source: 'visibility-case',
+    referenceId: 'workspace-permission-group-restricted',
+    owns: 'permission-group restricted sidebar visibility',
+  },
+] as const satisfies readonly ExistingNavigationProof[]
+
+export const accessGateCases: readonly AccessGateCase[] = [
+  {
+    caseId: 'account-personal-paid-billing',
+    plane: 'account',
+    pathTemplate: '/account/settings/billing',
+    driver: { personaKey: 'personalPaidOwner' },
+    sidebar: { state: 'visible', label: 'Billing' },
+    outcome: {
+      kind: 'render',
+      heading: 'Billing',
+      readiness: { kind: 'button', name: 'Manage in Stripe' },
+      readinessState: 'enabled',
+      successfulResponse: invoiceResponse,
+    },
+  },
+  {
+    caseId: 'account-non-platform-admin-denied',
+    plane: 'account',
+    pathTemplate: '/account/settings/admin',
+    driver: { personaKey: 'personalPaidOwner' },
+    sidebar: { state: 'hidden', label: 'Admin' },
+    outcome: { kind: 'not-found' },
+  },
+  {
+    caseId: 'account-non-platform-mothership-denied',
+    plane: 'account',
+    pathTemplate: '/account/settings/mothership',
+    driver: { personaKey: 'personalPaidOwner' },
+    sidebar: { state: 'hidden', label: 'Mothership' },
+    outcome: { kind: 'not-found' },
+  },
+  {
+    caseId: 'organization-read-member-access-control-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/access-control',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Access control' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-read-member-audit-logs-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/audit-logs',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Audit logs' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-read-member-sso-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/sso',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Single sign-on' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-read-member-data-retention-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/data-retention',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Data retention' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-read-member-data-drains-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/data-drains',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Data drains' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-read-member-whitelabeling-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/whitelabeling',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Whitelabeling' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
+  {
+    caseId: 'organization-lapsed-owner-members',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/members',
+    driver: {
+      personaKey: 'freeOrganizationOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'lapsed-organization',
+      },
+    },
+    sidebar: { state: 'visible', label: 'Members' },
+    outcome: {
+      kind: 'render',
+      heading: 'Members',
+      readiness: { kind: 'button', name: 'Invite' },
+    },
+  },
+  {
+    caseId: 'organization-lapsed-owner-billing',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/billing',
+    driver: {
+      personaKey: 'freeOrganizationOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'lapsed-organization',
+      },
+    },
+    sidebar: { state: 'visible', label: 'Billing' },
+    outcome: {
+      kind: 'render',
+      heading: 'Billing',
+      readiness: { kind: 'button', name: 'Explore organization plans' },
+      readinessState: 'disabled',
+      successfulResponse: invoiceResponse,
+    },
+  },
+  {
+    caseId: 'organization-team-owner-billing',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/billing',
+    driver: {
+      personaKey: 'paidOrganizationOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'visible', label: 'Billing' },
+    outcome: {
+      kind: 'render',
+      heading: 'Billing',
+      readiness: { kind: 'button', name: 'Manage in Stripe' },
+      readinessState: 'enabled',
+      successfulResponse: invoiceResponse,
+    },
+  },
+  ...[
+    ['access-control', 'Access control'],
+    ['audit-logs', 'Audit logs'],
+    ['sso', 'Single sign-on'],
+    ['data-retention', 'Data retention'],
+    ['data-drains', 'Data drains'],
+    ['whitelabeling', 'Whitelabeling'],
+  ].map(
+    ([section, label]) =>
+      ({
+        caseId: `organization-lapsed-owner-${section}-plan-denied`,
+        plane: 'organization',
+        pathTemplate: `/organization/{organizationId}/settings/${section}`,
+        driver: {
+          personaKey: 'freeOrganizationOwner',
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'organization',
+            resourceKey: 'lapsed-organization',
+          },
+        },
+        sidebar: { state: 'hidden', label },
+        outcome: { kind: 'organization-plan-unavailable', title: 'Setting unavailable' },
+      }) as AccessGateCase
+  ),
+  {
+    caseId: 'workspace-foreign-access-denied',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/general',
+    driver: {
+      personaKey: 'personalFreeOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'team-workspace',
+      },
+    },
+    sidebar: { state: 'absent-shell' },
+    outcome: { kind: 'workspace-access-denied' },
+  },
+  ...[
+    ['organization', 'Organization'],
+    ['billing', 'Billing'],
+    ['access-control', 'Access control'],
+    ['audit-logs', 'Audit logs'],
+    ['sso', 'Single sign-on'],
+    ['data-retention', 'Data retention'],
+    ['data-drains', 'Data drains'],
+    ['whitelabeling', 'Whitelabeling'],
+  ].map(
+    ([section, label]) =>
+      ({
+        caseId: `workspace-member-${section}-denied`,
+        plane: 'workspace',
+        pathTemplate: `/workspace/{workspaceId}/settings/${section}`,
+        driver: {
+          personaKey: 'workspaceAdminMember',
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        sidebar: { state: 'hidden', label },
+        outcome: { kind: 'not-found' },
+      }) as AccessGateCase
+  ),
+  {
+    caseId: 'workspace-external-admin-organization-denied',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/organization',
+    driver: {
+      personaKey: 'externalWorkspaceAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'team-workspace',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Organization' },
+    outcome: { kind: 'not-found' },
+  },
+  {
+    caseId: 'workspace-external-admin-billing-denied',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/billing',
+    driver: {
+      personaKey: 'externalWorkspaceAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'team-workspace',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Billing' },
+    outcome: { kind: 'not-found' },
+  },
+  {
+    caseId: 'workspace-enterprise-billing',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/billing',
+    driver: {
+      personaKey: 'enterpriseOrganizationAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'enterprise-workspace',
+      },
+    },
+    sidebar: { state: 'visible', label: 'Billing' },
+    outcome: {
+      kind: 'render',
+      heading: 'Billing',
+      readiness: { kind: 'button', name: 'Manage in Stripe' },
+      readinessState: 'disabled',
+      successfulResponse: invoiceResponse,
+    },
+  },
+  ...[
+    ['access-control', 'Access control'],
+    ['audit-logs', 'Audit logs'],
+    ['sso', 'Single sign-on'],
+    ['data-retention', 'Data retention'],
+    ['data-drains', 'Data drains'],
+    ['whitelabeling', 'Whitelabeling'],
+    ['forks', 'Workspace Forks'],
+    ['custom-blocks', 'Custom blocks'],
+  ].map(
+    ([section, label]) =>
+      ({
+        caseId: `workspace-team-owner-${section}-denied`,
+        plane: 'workspace',
+        pathTemplate: `/workspace/{workspaceId}/settings/${section}`,
+        driver: {
+          personaKey: 'paidOrganizationOwner',
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        sidebar: { state: 'hidden', label },
+        outcome: { kind: 'not-found' },
+      }) as AccessGateCase
+  ),
+  ...[
+    ['secrets', 'Secrets'],
+    ['apikeys', 'Sim API keys'],
+    ['inbox', 'Sim mailer'],
+    ['mcp', 'MCP tools'],
+    ['custom-tools', 'Custom tools'],
+  ].map(
+    ([section, label]) =>
+      ({
+        caseId: `workspace-permission-group-${section}-denied`,
+        plane: 'workspace',
+        pathTemplate: `/workspace/{workspaceId}/settings/${section}`,
+        driver: {
+          personaKey: 'permissionGroupRestricted',
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'enterprise-workspace',
+          },
+        },
+        sidebar: {
+          state: 'hidden',
+          label,
+          existingProofId: 'step3-permission-group-sidebar',
+        },
+        outcome: { kind: 'not-found' },
+      }) as AccessGateCase
+  ),
+  {
+    caseId: 'workspace-personal-paid-inbox-locked',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/inbox',
+    driver: {
+      personaKey: 'personalPaidOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'personal-paid-workspace',
+      },
+    },
+    sidebar: { state: 'locked', label: 'Sim mailer' },
+    outcome: {
+      kind: 'locked-render',
+      heading: 'Sim Mailer requires an active Max plan',
+      headingLevel: 3,
+      readiness: { kind: 'button', name: 'Upgrade to Max' },
+      readinessState: 'enabled',
+    },
+  },
+  {
+    caseId: 'workspace-personal-paid-billing',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/billing',
+    driver: {
+      personaKey: 'personalPaidOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'personal-paid-workspace',
+      },
+    },
+    sidebar: { state: 'visible', label: 'Billing' },
+    outcome: {
+      kind: 'render',
+      heading: 'Billing',
+      readiness: { kind: 'button', name: 'Manage in Stripe' },
+      readinessState: 'enabled',
+      successfulResponse: invoiceResponse,
+    },
+  },
+  {
+    caseId: 'workspace-non-platform-admin-denied',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/admin',
+    driver: {
+      personaKey: 'personalPaidOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'personal-paid-workspace',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Admin' },
+    outcome: { kind: 'not-found' },
+  },
+  {
+    caseId: 'workspace-non-platform-mothership-denied',
+    plane: 'workspace',
+    pathTemplate: '/workspace/{workspaceId}/settings/mothership',
+    driver: {
+      personaKey: 'personalPaidOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'personal-paid-workspace',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Mothership' },
+    outcome: { kind: 'not-found' },
+  },
+] as const
+
+export const mutationControlCases: readonly MutationControlCase[] = [
+  ...[
+    ['workspaceReadMember', 'absent'],
+    ['workspaceWriteMember', 'present'],
+    ['workspaceAdminMember', 'present'],
+  ].map(
+    ([personaKey, expectation]) =>
+      ({
+        caseId: `workspace-secrets-${personaKey}`,
+        pathTemplate: '/workspace/{workspaceId}/settings/secrets',
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'text', value: 'Personal' },
+        controls: [
+          {
+            probeId: 'new-workspace-secret-name',
+            control: { kind: 'textbox', name: 'New workspace secret name' },
+            scope: { kind: 'section', name: 'Workspace' },
+            expectation,
+          },
+          {
+            probeId: 'new-workspace-secret-value',
+            control: { kind: 'textbox', name: 'New workspace secret value' },
+            scope: { kind: 'section', name: 'Workspace' },
+            expectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  ...[
+    ['custom-tools', 'Add tool', 'workspaceReadMember', 'absent', 'No custom tools configured'],
+    [
+      'custom-tools',
+      'Add tool',
+      'workspaceWriteMember',
+      'present',
+      'Click "Add tool" above to get started',
+    ],
+    [
+      'custom-tools',
+      'Add tool',
+      'workspaceAdminMember',
+      'present',
+      'Click "Add tool" above to get started',
+    ],
+    ['mcp', 'Add server', 'workspaceReadMember', 'absent', 'No MCP servers configured'],
+    [
+      'mcp',
+      'Add server',
+      'workspaceWriteMember',
+      'present',
+      'Click "Add server" above to get started',
+    ],
+    [
+      'mcp',
+      'Add server',
+      'workspaceAdminMember',
+      'present',
+      'Click "Add server" above to get started',
+    ],
+    [
+      'workflow-mcp-servers',
+      'Add server',
+      'workspaceReadMember',
+      'absent',
+      'No MCP servers configured',
+    ],
+    [
+      'workflow-mcp-servers',
+      'Add server',
+      'workspaceWriteMember',
+      'present',
+      'Click "Add server" above to get started',
+    ],
+    [
+      'workflow-mcp-servers',
+      'Add server',
+      'workspaceAdminMember',
+      'present',
+      'Click "Add server" above to get started',
+    ],
+  ].map(
+    ([section, button, personaKey, expectation, readiness]) =>
+      ({
+        caseId: `workspace-${section}-${personaKey}`,
+        pathTemplate: `/workspace/{workspaceId}/settings/${section}`,
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'text', value: readiness },
+        controls: [
+          {
+            probeId: `${section}-primary-action`,
+            control: { kind: 'button', name: button },
+            scope: { kind: 'page' },
+            expectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  ...[
+    ['workspaceReadMember', 'absent'],
+    ['workspaceWriteMember', 'absent'],
+    ['workspaceAdminMember', 'present'],
+  ].map(
+    ([personaKey, expectation]) =>
+      ({
+        caseId: `workspace-teammates-${personaKey}`,
+        pathTemplate: '/workspace/{workspaceId}/settings/teammates',
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'text-pattern', source: '^Teammates \\(\\d+\\)$' },
+        controls: [
+          {
+            probeId: 'teammates-invite',
+            control: { kind: 'button', name: 'Invite' },
+            scope: { kind: 'page' },
+            expectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  ...[
+    ['workspaceReadMember', 'absent'],
+    ['workspaceWriteMember', 'absent'],
+    ['workspaceAdminMember', 'present'],
+  ].map(
+    ([personaKey, expectation]) =>
+      ({
+        caseId: `workspace-byok-${personaKey}`,
+        pathTemplate: '/workspace/{workspaceId}/settings/byok',
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'text', value: 'OpenAI' },
+        controls: [
+          {
+            probeId: 'openai-add-key',
+            control: { kind: 'button', name: 'Add Key' },
+            scope: { kind: 'row', name: 'OpenAI' },
+            expectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  ...[
+    ['workspaceReadMember', 'absent'],
+    ['workspaceWriteMember', 'present'],
+    ['workspaceAdminMember', 'present'],
+  ].map(
+    ([personaKey, expectation]) =>
+      ({
+        caseId: `workspace-recently-deleted-${personaKey}`,
+        pathTemplate: '/workspace/{workspaceId}/settings/recently-deleted',
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'textbox', name: 'Search deleted items...' },
+        arrangement: 'archived-workflow',
+        controls: [
+          {
+            probeId: 'archived-workflow-restore',
+            control: { kind: 'button', name: 'Restore' },
+            scope: { kind: 'row', name: '{archivedWorkflowName}' },
+            expectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  ...[
+    ['workspaceReadMember', 'absent', 'absent', 'absent'],
+    ['workspaceWriteMember', 'absent', 'absent', 'absent'],
+    ['workspaceAdminMember', 'present', 'present', 'present'],
+  ].map(
+    ([personaKey, radioExpectation, workspaceRadioExpectation, policyExpectation]) =>
+      ({
+        caseId: `workspace-api-keys-${personaKey}`,
+        pathTemplate: '/workspace/{workspaceId}/settings/apikeys',
+        driver: {
+          personaKey,
+          binding: {
+            worldKey: 'settings-primary',
+            resourceKind: 'workspace',
+            resourceKey: 'team-workspace',
+          },
+        },
+        readiness: { kind: 'button', name: 'Create API key' },
+        openDialogWith: { kind: 'button', name: 'Create API key' },
+        controls: [
+          {
+            probeId: 'personal-key-create',
+            control: { kind: 'button', name: 'Create API key' },
+            scope: { kind: 'page' },
+            expectation: 'enabled',
+          },
+          {
+            probeId: 'personal-key-radio',
+            control: { kind: 'radio', name: 'Personal' },
+            scope: { kind: 'dialog', name: 'Create new API key' },
+            expectation: radioExpectation,
+          },
+          {
+            probeId: 'workspace-key-radio',
+            control: { kind: 'radio', name: 'Workspace' },
+            scope: { kind: 'dialog', name: 'Create new API key' },
+            expectation: workspaceRadioExpectation,
+          },
+          {
+            probeId: 'allow-personal-api-keys',
+            control: { kind: 'switch', name: 'Allow personal API keys' },
+            scope: { kind: 'section', name: 'Permissions' },
+            expectation: policyExpectation,
+          },
+        ],
+      }) as MutationControlCase
+  ),
+  {
+    caseId: 'workspace-paid-non-max-inbox-upgrade',
+    pathTemplate: '/workspace/{workspaceId}/settings/inbox',
+    driver: {
+      personaKey: 'personalPaidOwner',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'personal-paid-workspace',
+      },
+    },
+    readiness: { kind: 'text', value: 'Sim Mailer requires an active Max plan' },
+    controls: [
+      {
+        probeId: 'inbox-upgrade',
+        control: { kind: 'button', name: 'Upgrade to Max' },
+        scope: { kind: 'page' },
+        expectation: 'present',
+      },
+    ],
+  },
+  {
+    caseId: 'workspace-enterprise-forks-create',
+    pathTemplate: '/workspace/{workspaceId}/settings/forks',
+    driver: {
+      personaKey: 'enterpriseOrganizationAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'enterprise-workspace',
+      },
+    },
+    readiness: { kind: 'textbox', name: 'Search forks...' },
+    controls: [
+      {
+        probeId: 'forks-create',
+        control: { kind: 'button', name: 'Create fork' },
+        scope: { kind: 'page' },
+        expectation: 'present',
+      },
+    ],
+  },
+  {
+    caseId: 'workspace-enterprise-read-custom-blocks',
+    pathTemplate: '/workspace/{workspaceId}/settings/custom-blocks',
+    driver: {
+      personaKey: 'permissionGroupRestricted',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'enterprise-workspace',
+      },
+    },
+    readiness: { kind: 'textbox', name: 'Search custom blocks...' },
+    controls: [
+      {
+        probeId: 'custom-block-create',
+        control: { kind: 'button', name: 'Create block' },
+        scope: { kind: 'page' },
+        expectation: 'absent',
+      },
+    ],
+  },
+  {
+    caseId: 'workspace-enterprise-admin-custom-blocks',
+    pathTemplate: '/workspace/{workspaceId}/settings/custom-blocks',
+    driver: {
+      personaKey: 'enterpriseOrganizationAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'workspace',
+        resourceKey: 'enterprise-workspace',
+      },
+    },
+    readiness: { kind: 'textbox', name: 'Search custom blocks...' },
+    controls: [
+      {
+        probeId: 'custom-block-create',
+        control: { kind: 'button', name: 'Create block' },
+        scope: { kind: 'page' },
+        expectation: 'present',
+      },
+    ],
+  },
+  {
+    caseId: 'organization-member-members-controls',
+    pathTemplate: '/organization/{organizationId}/settings/members',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    readiness: { kind: 'text-pattern', source: '^Members \\(\\d+\\)$' },
+    controls: [
+      {
+        probeId: 'organization-members-invite',
+        control: { kind: 'button', name: 'Invite' },
+        scope: { kind: 'page' },
+        expectation: 'absent',
+      },
+    ],
+  },
+  {
+    caseId: 'organization-admin-members-controls',
+    pathTemplate: '/organization/{organizationId}/settings/members',
+    driver: {
+      personaKey: 'enterpriseOrganizationAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'enterprise-organization',
+      },
+    },
+    readiness: { kind: 'text-pattern', source: '^Members \\(\\d+\\)$' },
+    controls: [
+      {
+        probeId: 'organization-members-invite',
+        control: { kind: 'button', name: 'Invite' },
+        scope: { kind: 'page' },
+        expectation: 'present',
+      },
+    ],
+  },
+  {
+    caseId: 'organization-enterprise-access-control-create',
+    pathTemplate: '/organization/{organizationId}/settings/access-control',
+    driver: {
+      personaKey: 'enterpriseOrganizationAdmin',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'enterprise-organization',
+      },
+    },
+    readiness: { kind: 'textbox', name: 'Search permission groups...' },
+    controls: [
+      {
+        probeId: 'organization-access-control-create',
+        control: { kind: 'button', name: 'Create group' },
+        scope: { kind: 'page' },
+        expectation: 'present',
+      },
+    ],
+  },
+] as const
diff --git a/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts b/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
new file mode 100644
index 00000000000..b0476344ebf
--- /dev/null
+++ b/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
@@ -0,0 +1,207 @@
+import { randomUUID } from 'node:crypto'
+import type { Locator, Page } from '@playwright/test'
+import { expect, test } from '../../fixtures/persona-test'
+import {
+  absoluteE2eUrl,
+  readinessLocator,
+  resolveContractPath,
+} from '../navigation/contract-resolver'
+import type {
+  AuthorizationReadiness,
+  ControlScope,
+  MutationControlCase,
+  MutationControlProbe,
+  SemanticControl,
+} from './contracts'
+import { mutationControlCases } from './contracts'
+
+for (const literalCase of mutationControlCases.filter(
+  ({ arrangement }) => arrangement !== 'archived-workflow'
+)) {
+  const mutationCase: MutationControlCase = literalCase
+
+  test(`${mutationCase.caseId} exposes only its authorized mutation controls`, async ({
+    contextForPersona,
+    personaManifest,
+  }) => {
+    const context = await contextForPersona(mutationCase.driver.personaKey)
+    const page = await context.newPage()
+    const path = resolveContractPath(
+      personaManifest,
+      mutationCase.pathTemplate,
+      mutationCase.driver
+    )
+
+    const response = await page.goto(absoluteE2eUrl(path))
+    expect(response?.ok(), `${mutationCase.caseId} document response`).toBe(true)
+    await expect(page).toHaveURL(absoluteE2eUrl(path))
+    await expectMutationPermissionsReady(page, mutationCase.pathTemplate)
+    await expectAuthorizationReadiness(page, mutationCase.readiness)
+
+    for (const probe of mutationCase.controls.filter(({ scope }) => scope.kind !== 'dialog')) {
+      await assertControlProbe(page, probe)
+    }
+
+    if (mutationCase.openDialogWith) {
+      const trigger = controlLocator(page, mutationCase.openDialogWith)
+      await expect(trigger).toBeVisible()
+      await expect(trigger).toBeEnabled()
+      await trigger.click()
+    }
+
+    for (const probe of mutationCase.controls.filter(({ scope }) => scope.kind === 'dialog')) {
+      await assertControlProbe(page, probe)
+    }
+  })
+}
+
+test('Recently deleted scopes Restore to write and admin access', async ({
+  contextForPersona,
+  personaManifest,
+}) => {
+  const archivedCases = mutationControlCases.filter(
+    ({ arrangement }) => arrangement === 'archived-workflow'
+  )
+  expect(archivedCases.map(({ driver }) => driver.personaKey)).toEqual([
+    'workspaceReadMember',
+    'workspaceWriteMember',
+    'workspaceAdminMember',
+  ])
+
+  const ownerContext = await contextForPersona('paidOrganizationOwner')
+  const workspaceId = personaManifest.worlds['settings-primary'].workspaceIds['team-workspace']
+  if (!workspaceId) throw new Error('Missing team-workspace binding for archived workflow')
+
+  const guardWorkflowName = `e2e-authorization-guard-${randomUUID()}`
+  const guardResponse = await ownerContext.request.post('/api/workflows', {
+    data: { name: guardWorkflowName, description: '', workspaceId },
+  })
+  expect(guardResponse.status(), 'workflow arrangement guard POST').toBe(200)
+  await expect(guardResponse.json()).resolves.toMatchObject({
+    id: expect.any(String),
+    name: guardWorkflowName,
+    workspaceId,
+  })
+
+  const workflowName = `e2e-authorization-archived-${randomUUID()}`
+  const createResponse = await ownerContext.request.post('/api/workflows', {
+    data: { name: workflowName, description: '', workspaceId },
+  })
+  expect(createResponse.status(), 'workflow arrangement POST').toBe(200)
+  const created = (await createResponse.json()) as {
+    id?: string
+    name?: string
+    workspaceId?: string
+  }
+  expect(created).toMatchObject({ name: workflowName, workspaceId })
+  expect(created.id).toBeTruthy()
+
+  const deleteResponse = await ownerContext.request.delete(
+    `/api/workflows/${encodeURIComponent(created.id ?? '')}`
+  )
+  const deletePayload = await deleteResponse.json()
+  expect(
+    deleteResponse.status(),
+    `workflow arrangement DELETE: ${JSON.stringify(deletePayload)}`
+  ).toBe(200)
+  expect(deletePayload).toEqual({ success: true })
+
+  for (const archivedCase of archivedCases) {
+    const context = await contextForPersona(archivedCase.driver.personaKey)
+    const page = await context.newPage()
+    const path = resolveContractPath(
+      personaManifest,
+      archivedCase.pathTemplate,
+      archivedCase.driver
+    )
+    const response = await page.goto(absoluteE2eUrl(path))
+    expect(response?.ok(), `${archivedCase.caseId} document response`).toBe(true)
+    await expectMutationPermissionsReady(page, archivedCase.pathTemplate)
+    await expectAuthorizationReadiness(page, archivedCase.readiness)
+    await expect(page.getByText(workflowName, { exact: true })).toBeVisible()
+
+    for (const probe of archivedCase.controls) {
+      await assertControlProbe(page, {
+        ...probe,
+        scope: probe.scope.kind === 'row' ? { ...probe.scope, name: workflowName } : probe.scope,
+      })
+    }
+  }
+})
+
+async function expectAuthorizationReadiness(
+  page: Page,
+  readiness: AuthorizationReadiness
+): Promise<void> {
+  if (readiness.kind === 'text-pattern') {
+    await expect(page.getByText(new RegExp(readiness.source))).toBeVisible()
+    return
+  }
+  await expect(readinessLocator(page, readiness)).toBeVisible()
+}
+
+async function expectMutationPermissionsReady(page: Page, pathTemplate: string): Promise<void> {
+  if (pathTemplate.startsWith('/workspace/')) {
+    const sidebar = page.getByRole('complementary', { name: 'Workspace sidebar' })
+    await expect(
+      sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
+    ).toHaveAttribute('aria-busy', 'false')
+    return
+  }
+
+  if (pathTemplate.endsWith('/settings/members')) {
+    await expect(page.getByRole('region', { name: 'Organization members' })).toHaveAttribute(
+      'aria-busy',
+      'false'
+    )
+  }
+}
+
+async function assertControlProbe(page: Page, probe: MutationControlProbe): Promise<void> {
+  const scope = scopeLocator(page, probe.scope)
+  if (probe.scope.kind === 'dialog') await expect(scope).toBeVisible()
+  const control = controlLocator(scope, probe.control)
+
+  switch (probe.expectation) {
+    case 'absent':
+      await expect(control, probe.probeId).toHaveCount(0)
+      break
+    case 'present':
+      await expect(control, probe.probeId).toBeVisible()
+      break
+    case 'enabled':
+      await expect(control, probe.probeId).toBeVisible()
+      await expect(control, probe.probeId).toBeEnabled()
+      break
+    case 'disabled':
+      await expect(control, probe.probeId).toBeVisible()
+      await expect(control, probe.probeId).toBeDisabled()
+      break
+  }
+}
+
+function scopeLocator(page: Page, scope: ControlScope): Locator {
+  switch (scope.kind) {
+    case 'page':
+      return page.locator('body')
+    case 'dialog':
+      return page.getByRole('dialog', { name: scope.name, exact: true })
+    case 'section':
+      return page.getByRole('region', { name: scope.name, exact: true })
+    case 'row':
+      return page.getByRole('group', { name: scope.name, exact: true })
+  }
+}
+
+function controlLocator(scope: Page | Locator, control: SemanticControl): Locator {
+  switch (control.kind) {
+    case 'button':
+      return scope.getByRole('button', { name: control.name, exact: true })
+    case 'textbox':
+      return scope.getByRole('textbox', { name: control.name, exact: true })
+    case 'switch':
+      return scope.getByRole('switch', { name: control.name, exact: true })
+    case 'radio':
+      return scope.getByRole('radio', { name: control.name, exact: true })
+  }
+}
diff --git a/apps/sim/e2e/settings/authorization/unsaved-changes.spec.ts b/apps/sim/e2e/settings/authorization/unsaved-changes.spec.ts
new file mode 100644
index 00000000000..2da913e02ba
--- /dev/null
+++ b/apps/sim/e2e/settings/authorization/unsaved-changes.spec.ts
@@ -0,0 +1,153 @@
+import type { Locator } from '@playwright/test'
+import { expect, test } from '../../fixtures/persona-test'
+import { absoluteE2eUrl, resolveContractPath } from '../navigation/contract-resolver'
+
+const enterpriseOrganizationDriver = {
+  personaKey: 'enterpriseOrganizationAdmin',
+  binding: {
+    worldKey: 'settings-primary',
+    resourceKind: 'organization',
+    resourceKey: 'enterprise-organization',
+  },
+} as const
+
+const enterpriseWorkspaceDriver = {
+  personaKey: 'enterpriseOrganizationAdmin',
+  binding: {
+    worldKey: 'settings-primary',
+    resourceKind: 'workspace',
+    resourceKey: 'enterprise-workspace',
+  },
+} as const
+
+test('organization section navigation keeps or discards Whitelabeling edits', async ({
+  contextForPersona,
+  personaManifest,
+}) => {
+  const context = await contextForPersona(enterpriseOrganizationDriver.personaKey)
+  const page = await context.newPage()
+  const whitelabelPath = resolveContractPath(
+    personaManifest,
+    '/organization/{organizationId}/settings/whitelabeling',
+    enterpriseOrganizationDriver
+  )
+  const membersPath = resolveContractPath(
+    personaManifest,
+    '/organization/{organizationId}/settings/members',
+    enterpriseOrganizationDriver
+  )
+  await page.goto(absoluteE2eUrl(whitelabelPath))
+
+  const brandName = page.getByRole('textbox', { name: 'Brand name', exact: true })
+  const dirtyValue = await dirtyBrandName(brandName)
+  await expect(page.getByRole('button', { name: 'Discard', exact: true })).toBeVisible()
+  const sidebar = page.getByRole('complementary', {
+    name: 'Organization settings navigation',
+  })
+  const members = sidebar.getByRole('button', { name: 'Members', exact: true })
+
+  await members.click()
+  const dialog = page.getByRole('dialog', { name: 'Unsaved changes', exact: true })
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('button', { name: 'Keep editing', exact: true }).click()
+  await expect(page).toHaveURL(absoluteE2eUrl(whitelabelPath))
+  await expect(brandName).toHaveValue(dirtyValue)
+
+  await members.click()
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('button', { name: 'Discard changes', exact: true }).click()
+  await expect(page).toHaveURL(absoluteE2eUrl(membersPath))
+  await expect(page.getByRole('heading', { name: 'Members', level: 1, exact: true })).toBeVisible()
+})
+
+test('workspace app Back returns to the real entry route after keep then discard', async ({
+  contextForPersona,
+  personaManifest,
+}) => {
+  const context = await contextForPersona(enterpriseWorkspaceDriver.personaKey)
+  const page = await context.newPage()
+  const workspaceId =
+    personaManifest.worlds['settings-primary'].workspaceIds['enterprise-workspace']
+  if (!workspaceId) throw new Error('Missing enterprise-workspace binding')
+
+  const homePath = `/workspace/${encodeURIComponent(workspaceId)}/home`
+  const generalPath = resolveContractPath(
+    personaManifest,
+    '/workspace/{workspaceId}/settings/general',
+    enterpriseWorkspaceDriver
+  )
+  const whitelabelPath = resolveContractPath(
+    personaManifest,
+    '/workspace/{workspaceId}/settings/whitelabeling',
+    enterpriseWorkspaceDriver
+  )
+
+  await page.goto(absoluteE2eUrl(homePath))
+  const settingsEntry = page.getByRole('link', { name: 'Settings', exact: true })
+  await expect(settingsEntry).toBeVisible()
+  await settingsEntry.click()
+  await expect(page).toHaveURL(absoluteE2eUrl(generalPath))
+
+  const sidebar = page.getByRole('complementary', { name: 'Workspace sidebar' })
+  await sidebar.getByRole('button', { name: 'Whitelabeling', exact: true }).click()
+  await expect(page).toHaveURL(absoluteE2eUrl(whitelabelPath))
+
+  const brandName = page.getByRole('textbox', { name: 'Brand name', exact: true })
+  const dirtyValue = await dirtyBrandName(brandName)
+  await expect(page.getByRole('button', { name: 'Discard', exact: true })).toBeVisible()
+  const back = sidebar.getByRole('button', { name: 'Back', exact: true })
+
+  await back.click()
+  const dialog = page.getByRole('dialog', { name: 'Unsaved changes', exact: true })
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('button', { name: 'Keep editing', exact: true }).click()
+  await expect(page).toHaveURL(absoluteE2eUrl(whitelabelPath))
+  await expect(brandName).toHaveValue(dirtyValue)
+
+  await back.click()
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('button', { name: 'Discard changes', exact: true }).click()
+  await expect(page).toHaveURL(absoluteE2eUrl(homePath))
+  await expect
+    .poll(() => page.evaluate(() => sessionStorage.getItem('settings-return-url')))
+    .toBeNull()
+})
+
+test('native beforeunload dismissal keeps the dirty page open', async ({
+  contextForPersona,
+  personaManifest,
+}) => {
+  const context = await contextForPersona(enterpriseOrganizationDriver.personaKey)
+  const page = await context.newPage()
+  const whitelabelPath = resolveContractPath(
+    personaManifest,
+    '/organization/{organizationId}/settings/whitelabeling',
+    enterpriseOrganizationDriver
+  )
+  await page.goto(absoluteE2eUrl(whitelabelPath))
+
+  const brandName = page.getByRole('textbox', { name: 'Brand name', exact: true })
+  const dirtyValue = await dirtyBrandName(brandName)
+  await expect(page.getByRole('button', { name: 'Discard', exact: true })).toBeVisible()
+  await expect(page.getByRole('dialog', { name: 'Unsaved changes', exact: true })).toHaveCount(0)
+
+  const dialogPromise = page.waitForEvent('dialog')
+  const closePromise = page.close({ runBeforeUnload: true })
+  const dialog = await dialogPromise
+  expect(dialog.type()).toBe('beforeunload')
+  await dialog.dismiss()
+  await closePromise
+
+  expect(page.isClosed()).toBe(false)
+  await expect(page).toHaveURL(absoluteE2eUrl(whitelabelPath))
+  await expect(brandName).toHaveValue(dirtyValue)
+})
+
+async function dirtyBrandName(brandName: Locator): Promise<string> {
+  await expect(brandName).toBeVisible()
+  const original = await brandName.inputValue()
+  const dirtyValue = original ? `${original.slice(0, 48)}-unsaved` : 'E2E unsaved brand'
+  await brandName.fill(dirtyValue)
+  await expect(brandName).toHaveValue(dirtyValue)
+  return dirtyValue
+}
diff --git a/apps/sim/e2e/settings/navigation/contracts.ts b/apps/sim/e2e/settings/navigation/contracts.ts
index fe0ae85b6a4..e825a308537 100644
--- a/apps/sim/e2e/settings/navigation/contracts.ts
+++ b/apps/sim/e2e/settings/navigation/contracts.ts
@@ -341,14 +341,11 @@ export const sectionContracts = [
       'enterprise',
       'Custom blocks',
       'Publish workflows as reusable blocks for your organization.',
-      {
-        kind: 'text',
-        value: 'Custom blocks require an Enterprise plan. Contact your admin to enable them.',
-      },
+      { kind: 'textbox', name: 'Search custom blocks...' },
       enterpriseWorkspace,
       {
         path: '/api/custom-blocks',
-        expectedJson: { enabled: false, customBlocks: [] },
+        expectedJson: { enabled: true, customBlocks: [] },
       },
     ],
     [
diff --git a/apps/sim/e2e/settings/persona-contracts.spec.ts b/apps/sim/e2e/settings/persona-contracts.spec.ts
index c898ba8c140..a4bbddda3d5 100644
--- a/apps/sim/e2e/settings/persona-contracts.spec.ts
+++ b/apps/sim/e2e/settings/persona-contracts.spec.ts
@@ -35,22 +35,6 @@ for (const personaKey of SETTINGS_PERSONA_KEYS) {
     await page.goto(canonicalUrl)
     await expect(page).toHaveURL(canonicalUrl)
     await expect(page.getByRole('heading', { name: 'General', level: 1 })).toBeVisible()
-    if (personaKey === 'permissionGroupRestricted') {
-      await expect(page.getByRole('button', { name: 'General', exact: true })).toBeVisible()
-      for (const label of ['Secrets', 'Sim API keys', 'Sim mailer', 'MCP tools', 'Custom tools']) {
-        await expect(page.getByRole('button', { name: label, exact: true })).toHaveCount(0)
-      }
-      const workspaceId = persona.workspaces.find(({ access }) => access !== 'none')?.workspaceId
-      expect(workspaceId).toBeTruthy()
-      for (const section of ['secrets', 'api-keys', 'inbox', 'mcp', 'custom-tools']) {
-        const deniedUrl = new URL(
-          `/workspace/${encodeURIComponent(workspaceId ?? '')}/settings/${section}`,
-          requiredEnv('E2E_BASE_URL')
-        ).toString()
-        const response = await page.goto(deniedUrl)
-        expect(response?.status(), `${section} must be denied by the server route gate`).toBe(404)
-      }
-    }
 
     const sessionResponse = await context.request.get('/api/auth/get-session')
     expect(sessionResponse.status()).toBe(200)
diff --git a/apps/sim/e2e/support/deployment-profile.ts b/apps/sim/e2e/support/deployment-profile.ts
index 2dc238edb42..ba63d1a89f5 100644
--- a/apps/sim/e2e/support/deployment-profile.ts
+++ b/apps/sim/e2e/support/deployment-profile.ts
@@ -55,6 +55,7 @@ const APP_ENVIRONMENT_KEYS = [
   'SIGNUP_MX_VALIDATION_ENABLED',
   'NEXT_PUBLIC_POSTHOG_ENABLED',
   'BLACKLISTED_PROVIDERS',
+  'DEPLOY_AS_BLOCK',
   'STRIPE_WEBHOOK_SECRET',
   'STRIPE_FREE_PRICE_ID',
   'SOCKET_SERVER_URL',
@@ -147,6 +148,7 @@ export function createHostedBillingProfile({
     SIGNUP_MX_VALIDATION_ENABLED: 'false',
     NEXT_PUBLIC_POSTHOG_ENABLED: 'false',
     BLACKLISTED_PROVIDERS: 'ollama,ollama-cloud,vllm,litellm,openrouter,together,fireworks,baseten',
+    DEPLOY_AS_BLOCK: 'true',
     STRIPE_SECRET_KEY: runtimeSecrets.stripeSecretKey,
     STRIPE_WEBHOOK_SECRET: runtimeSecrets.stripeWebhookSecret,
     STRIPE_FREE_PRICE_ID: 'price_e2e_free',
diff --git a/apps/sim/ee/components/setting-row.tsx b/apps/sim/ee/components/setting-row.tsx
index 4d854cd908a..7b04f08b146 100644
--- a/apps/sim/ee/components/setting-row.tsx
+++ b/apps/sim/ee/components/setting-row.tsx
@@ -3,17 +3,26 @@ import { Info } from 'lucide-react'
 
 interface SettingRowProps {
   label: string
+  htmlFor?: string
   description?: string
   /** Optional supplementary guidance shown in a tooltip on an info icon beside the label. */
   labelTooltip?: string
   children: React.ReactNode
 }
 
-export function SettingRow({ label, description, labelTooltip, children }: SettingRowProps) {
+export function SettingRow({
+  label,
+  htmlFor,
+  description,
+  labelTooltip,
+  children,
+}: SettingRowProps) {
   return (
     <div className='flex flex-col gap-1.5'>
       <div className='flex items-center gap-1.5'>
-        <Label className='text-[var(--text-primary)] text-small'>{label}</Label>
+        <Label htmlFor={htmlFor} className='text-[var(--text-primary)] text-small'>
+          {label}
+        </Label>
         {labelTooltip && (
           <Tooltip.Root>
             <Tooltip.Trigger asChild>
diff --git a/apps/sim/ee/whitelabeling/components/whitelabeling-settings.tsx b/apps/sim/ee/whitelabeling/components/whitelabeling-settings.tsx
index 2b048031afb..94cd7d3a268 100644
--- a/apps/sim/ee/whitelabeling/components/whitelabeling-settings.tsx
+++ b/apps/sim/ee/whitelabeling/components/whitelabeling-settings.tsx
@@ -315,9 +315,11 @@ export function WhitelabelingSettings({ organizationId: orgId }: WhitelabelingSe
         <div className='flex flex-col gap-5'>
           <SettingRow
             label='Brand name'
+            htmlFor='whitelabel-brand-name'
             description='Replaces "Sim" in the sidebar and select UI elements.'
           >
             <ChipInput
+              id='whitelabel-brand-name'
               value={brandName}
               onChange={(e) => setBrandName(e.target.value)}
               placeholder='Your Company'
diff --git a/apps/sim/playwright.config.ts b/apps/sim/playwright.config.ts
index 17aca0d8e1e..9432b4c9063 100644
--- a/apps/sim/playwright.config.ts
+++ b/apps/sim/playwright.config.ts
@@ -48,10 +48,16 @@ export default defineConfig({
       ],
       workers: 2,
     },
+    {
+      name: 'hosted-billing-chromium-authorization',
+      testMatch: '**/settings/authorization/**/*.spec.ts',
+      dependencies: ['hosted-billing-chromium-navigation'],
+      workers: 2,
+    },
     {
       name: 'hosted-billing-chromium-workflows',
       testMatch: ['**/settings/smoke/authenticated.spec.ts', '**/settings/workflows/**/*.spec.ts'],
-      dependencies: ['hosted-billing-chromium-navigation'],
+      dependencies: ['hosted-billing-chromium-authorization'],
       fullyParallel: false,
       workers: 1,
     },

From fa8e1882174135805a265237affdee83f8009183 Mon Sep 17 00:00:00 2001
From: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Date: Tue, 21 Jul 2026 23:46:05 -0700
Subject: [PATCH 2/2] Clarify authorization readiness states

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../components/settings-sidebar/settings-sidebar.tsx  |  9 +++++++--
 .../settings/authorization/contract-integrity.spec.ts | 11 +++++++++++
 .../settings/authorization/mutation-controls.spec.ts  |  8 +++++---
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
index 04c72a5e9ff..70b7186e03e 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
@@ -75,7 +75,11 @@ export function SettingsSidebar({
   const forkingAvailable = useForkingAvailable(workspaceId)
   const { userPermissions } = useWorkspacePermissionsContext()
   const { canAdmin: canAdminWorkspace } = userPermissions
-  const permissionsReadinessBusy = userPermissions.isLoading || !userPermissions.canRead
+  const authorizationState = userPermissions.isLoading
+    ? 'loading'
+    : userPermissions.canRead
+      ? 'granted'
+      : 'denied'
 
   const userId = session?.user?.id
 
@@ -290,7 +294,8 @@ export function SettingsSidebar({
       <div
         role='navigation'
         aria-label='Workspace settings sections'
-        aria-busy={permissionsReadinessBusy}
+        aria-busy={authorizationState === 'loading'}
+        data-authorization-state={authorizationState}
         ref={isCollapsed ? undefined : scrollContainerRef}
         className={cn(
           'flex flex-1 flex-col overflow-y-auto overflow-x-hidden border-t pt-1.5 transition-colors duration-150',
diff --git a/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts b/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
index 81469e54574..a2543654c85 100644
--- a/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
+++ b/apps/sim/e2e/settings/authorization/contract-integrity.spec.ts
@@ -227,6 +227,17 @@ test('mutation contracts declare every required section and role boundary', () =
         pathTemplate.endsWith('/settings/access-control')
     )
   ).toBe(true)
+
+  expect(
+    mutationControlCases
+      .filter(
+        ({ pathTemplate, controls }) =>
+          pathTemplate.startsWith('/organization/') &&
+          controls.some(({ expectation }) => expectation === 'absent')
+      )
+      .map(({ caseId }) => caseId),
+    'organization absence probes must use the Members readiness barrier'
+  ).toEqual(['organization-member-members-controls'])
 })
 
 test('Step 4 paths stay canonical and separate from Step 3 special paths', () => {
diff --git a/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts b/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
index b0476344ebf..7f20bc3b318 100644
--- a/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
+++ b/apps/sim/e2e/settings/authorization/mutation-controls.spec.ts
@@ -143,12 +143,14 @@ async function expectAuthorizationReadiness(
 async function expectMutationPermissionsReady(page: Page, pathTemplate: string): Promise<void> {
   if (pathTemplate.startsWith('/workspace/')) {
     const sidebar = page.getByRole('complementary', { name: 'Workspace sidebar' })
-    await expect(
-      sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
-    ).toHaveAttribute('aria-busy', 'false')
+    const navigation = sidebar.getByRole('navigation', { name: 'Workspace settings sections' })
+    await expect(navigation).toHaveAttribute('aria-busy', 'false')
+    await expect(navigation).toHaveAttribute('data-authorization-state', 'granted')
     return
   }
 
+  // Members is the only organization route with an absent-control probe; the
+  // integrity spec requires any future organization absence case to add a barrier.
   if (pathTemplate.endsWith('/settings/members')) {
     await expect(page.getByRole('region', { name: 'Organization members' })).toHaveAttribute(
       'aria-busy',