fix(execution): stop treating the workflow owner as a live execution identity (#7330)

* fix(execution): stop treating the workflow owner as a live execution identity

A background run acts as the workspace billing account; `workflow.userId` is
only the personal-variable fallback. Several surfaces treated that stored
pointer as a live permission, so each broke when its owner left the workspace.

Deployed chat read `chat.userId` — the person who clicked "Deploy as chat" —
where every other trigger reads `workflow.userId`. Org member removal reassigns
`workflow.userId` to keep it an active workspace identity and has no equivalent
for the chat row, so the same transaction repaired the pointer every other
trigger reads and broke the only one chat read. Chat now passes the owner.

`getExecutionEnvironment` already tolerated a stale actor but not a stale
personal identity. Both are stored pointers, so a personal identity that cannot
reach the workspace now contributes no personal namespace — the judgment already
applied to an anonymous public-API run, and it stops lending a removed member's
secrets to their former organization. Only "neither identity reachable" raises.

The public API gated `validatePublicApiAllowed` and the workflow read on the
owner, though an anonymous call acts as the billing account and resolves no
personal variables at all. Both now use `getWorkspaceBilledAccountUserId`. The
enable-time gate, which checks the acting user, is unchanged.

Custom-block children and webhook provider-config resolved both environment
slices as the owner. They now split the two identities like any deployed run,
which also closes a silent inconsistency: a custom block saw a narrower
workspace-secret selection than a schedule on the very same workflow.

The ban gate no longer blocks on the workflow owner — banning one member should
not take down the schedules, webhooks, and chats their teammates depend on.

Logs gain a run-level `executedByEmail`, joined from the immutable per-run
attribution rather than from a workflow row that ownership transfer rewrites.
`workflow.ownerEmail` stays as a deprecated field, fed by its own aliased join,
because it is required in the published v2 schema.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(execution): suspend personal secrets for banned owners, and gate the ban candidate correctly

Review round 1 (Greptile P1 security, cubic P1 + P2).

Removing the workflow owner from the ban gate let a suspended account's personal
secrets keep flowing into background runs: a ban revokes neither workspace
membership nor the pointer naming that person, so the run continued on their own
keys. `getExecutionEnvironment` now drops the personal namespace when that
identity is suspended, the same answer it already gives a departed one — the run
survives, their credentials do not. Placing it in the shared resolver rather than
in `execution-core` covers the webhook and custom-block paths too, and keeps the
ban module out of the executor's import graph.

The ban candidate itself was also inconsistent: callers overload `userId`, so it
is an authenticated caller on a manual run but a stored pointer everywhere else —
the workflow owner from `checkWebhookPreprocessing`, the chat's creator from the
deployed-chat route, `'unknown'` from a schedule. Reading it unconditionally
meant the same ban suspended a webhook while the schedule beside it kept running.
It is now gated on `useAuthenticatedUserAsActor`, which is exactly the flag that
distinguishes the two — `workflow-column-execution` toggles them together.

Also corrects the custom-block authority TSDoc, which still claimed the owner
supplies both environment slices after this branch split them.

Regenerates the CLI API client for the v2 log contract change, which CI's
`check:cli-api` audit caught.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(execution): enforce suspension on every personal-secret path, and align webhook cleanup

Review round 2 (Greptile P1 security, cubic P0 — both found the same gap).

The suspension check sat next to the split-identity access lookups, so it was
skipped by the single-identity shortcut above it. That shortcut is taken whenever
the two identities coincide — which is exactly what happens when a custom-block
publisher is also their workspace's billing account. The check now runs before
the shortcut, unconditionally.

Round 1's placement rested on "admission already cleared this identity", and that
is not true everywhere: a custom-block child is admitted by
`admitCustomBlockChildExecution`, which checks usage limits and nothing else, and
a provider URL-validation challenge resolves its secret with no admission at all.
Neither path has ever had a ban gate.

Only the personal namespace is withheld. Workspace variables belong to the
workspace rather than to a person, so they keep resolving and a suspended
member's teammates keep working — the reason admission stopped blocking on this
identity to begin with.

Webhook cleanup now resolves through the same two-identity reader as delivery.
Reading both slices as the owner let cleanup see a narrower selection than the
delivery that created the subscription: a non-admin owner without a credential
grant left `{{VAR}}` unresolved, the provider was handed the literal reference as
its credential, and the non-fatal catch silently orphaned the subscription.

`resolveBackgroundWebhookEnv` imports the billing reader statically. The dynamic
import bought nothing — every boundary audit passes without it — and made each
worker pay a cold module load on the first webhook resolution.

Restores the `@sim/testing` mock-shape test, which pins that the default snapshot
carries every field of the real one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(webhooks): route every background env resolution through the identity resolver

Review round 3 (cubic P1).

`resolveBackgroundWebhookEnv` short-circuited to `getEffectiveDecryptedEnv` for
the two cases with no second identity — a legacy workspaceless webhook, and a
workspace with no billing account — which read the owner's variables without
passing the resolver's suspension check. cubic flagged the first; the second was
the same bypass one line down. Both now name the owner as both identities and go
through the resolver, which produces the identical resolution while putting them
behind the same gate.

Also corrects `provider-subscriptions.test.ts`, which still asserted cleanup
resolves via `getEffectiveDecryptedEnv`. That assertion was passing
intermittently rather than failing outright: `mockGetEffectiveDecryptedEnv` is a
shared singleton on `environmentUtilsMockFns`, so whether it had been called
depended on which other files shared the worker. It now asserts the two-identity
call, with the billing reader mocked so the split is actually exercised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(execution): make the suspension gate fail closed on an undeclared userId

Review round 4 (Greptile P1 security).

Round 2 keyed the ban candidate on `useAuthenticatedUserAsActor`, assuming that
flag separates a live caller from a stored reference. It does not. The
interactive resume route reads `access.auth?.userId` and passes that live
resumer as `userId` while leaving the flag false on purpose — attribution is
captured before the pause and must not move — so a suspended user could resume a
paused run whose persisted attribution named a different, unsuspended actor.

The distinction is per-caller and cannot be inferred, so it is now declared.
`userIdIsStoredReference` defaults to false, which means an undeclared call site
keeps blocking; only the three that genuinely pass a stored reference opt out:
the webhook processor (the workflow owner), the deployed-chat route (the chat's
creator), and table-cell dispatch (the owner, but only when nothing triggered
it). Resume, manual, API, and async paths are candidates again.

Withholding a suspended account's personal variables stays where it was, in
`getExecutionEnvironment`, so the two concerns remain separable: a suspended
stored reference does not block the run, and does not lend its credentials
either.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/docs/content/docs/platform/credentials.mdx

@@ -177,11 +177,13 @@ When a workflow runs, secrets resolve in this order:
 | Run started by | Personal secrets come from |
 | --- | --- |
 | Clicking Run, or a personal API key | The person running it |
-| A workspace API key, schedule, or webhook | The workflow owner |
+| A workspace API key, schedule, webhook, or deployed chat | The workflow owner |
 | A public API URL with no authentication | Nobody — personal secrets do not resolve |
 
 The workflow owner is the fallback only where nobody can be identified but somebody in the workspace set the trigger up, since those workflows are usually built against the owner's own keys. A public URL can be called by anyone, so it never borrows a person's keys at all — put every secret such a workflow needs in **Workspace**.
 
+If the workflow owner later leaves the workspace, the run keeps working: it resolves workspace secrets as normal and simply resolves no personal ones, so any block that needed a personal secret fails on its own with the missing key named. Move that secret to **Workspace** to fix it for good.
+
 ## Best Practices
 
 - **Use workspace secrets for production** so workflows work regardless of who triggers them
@@ -193,7 +195,8 @@ The workflow owner is the fallback only where nobody can be identified but someb
   { question: "Are my secrets encrypted at rest?", answer: "Yes. Values saved under Secrets are encrypted before being stored in the database." },
   { question: "Can a saved secret still appear in a workflow result?", answer: "Yes. Functional workflow data is not rewritten, so the raw value can still reach downstream blocks and tools and can appear in workflow execution responses, streams, or callbacks if your workflow deliberately returns or prints it. Log-facing views and read APIs receive a protected copy after a successful {{KEY}} resolution. Before content is sent to a model, exact values from the run's authorized secret catalog are replaced with placeholders, but encoded or otherwise transformed values remain outside that protection." },
   { question: "What happens if both a workspace secret and a personal secret have the same key name?", answer: "Among secrets available to the execution actor, the workspace secret takes precedence and the personal secret is the fallback. An inaccessible workspace secret does not shadow an authorized personal value." },
-  { question: "Who determines which personal secret is used for automated runs?", answer: "Whoever is running it, when that can be identified. Clicking Run or calling with a personal API key uses that person's personal secrets. A workspace API key, schedule, or webhook has no identifiable caller, so it falls back to the workflow owner's — those triggers are set up inside the workspace and the workflow is usually built against the owner's own keys. A public API URL with no authentication can be called by anyone, so no personal secrets resolve at all — those workflows run on workspace secrets only." },
+  { question: "Who determines which personal secret is used for automated runs?", answer: "Whoever is running it, when that can be identified. Clicking Run or calling with a personal API key uses that person's personal secrets. A workspace API key, schedule, webhook, or deployed chat has no identifiable caller, so it falls back to the workflow owner's — those triggers are set up inside the workspace and the workflow is usually built against the owner's own keys. A public API URL with no authentication can be called by anyone, so no personal secrets resolve at all — those workflows run on workspace secrets only." },
+  { question: "What happens to automated runs if the workflow owner leaves the workspace?", answer: "They keep running. Workspace secrets resolve as normal, because they are checked against the workspace's billing account rather than the owner. Personal secrets stop resolving, so any block that referenced one fails with that key named — move it to Workspace to fix it permanently." },
   { question: "Can I import secrets from a .env file?", answer: "Yes. Paste .env-style content (KEY=VALUE format) into any key or value field and the secrets will be auto-populated. The parser supports export KEY=VALUE, quoted values, and inline comments." },
   { question: "What happens if I delete a secret that is used in a workflow?", answer: "The workflow will fail at any block that references the deleted secret during execution because the value cannot be resolved. Update any references before deleting a secret." },
 ]} />

apps/docs/openapi-v2-logs.json

@@ -1344,6 +1344,19 @@
             ],
             "description": "Files the run produced, or null when none are recorded. Only the run's own output files appear; input attachments a caller supplied are addressed through the files API instead."
           },
+          "executedByEmail": {
+            "anyOf": [
+              {
+                "type": "string",
+                "format": "email",
+                "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Email of the identity the run executed as: the caller for an interactive or personal-API-key run, and the workspace billing account for a schedule, webhook, deployed chat, or public API call. Null when the run failed before an identity was resolved."
+          },
           "workflow": {
             "type": "object",
             "properties": {
@@ -1398,7 +1411,8 @@
                     "type": "null"
                   }
                 ],
-                "description": "Workflow owner email, or null when unavailable."
+                "description": "Deprecated — use the run-level `executedByEmail` instead. Email of the workflow's current owner, or null when unavailable. This is a property of the workflow as it stands today, not of the run: it changes when workflow ownership is reassigned, and the owner is not the identity a background run executes as.",
+                "deprecated": true
               },
               "workspaceId": {
                 "anyOf": [
@@ -1577,6 +1591,7 @@
           "endedAt",
           "totalDurationMs",
           "files",
+          "executedByEmail",
           "workflow",
           "workflowState",
           "traceSpans",
@@ -1614,6 +1629,7 @@
               "endedAt": "2026-01-15T10:30:01.250Z",
               "totalDurationMs": 1250,
               "files": null,
+              "executedByEmail": "billing@example.com",
               "workflow": {
                 "id": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
                 "name": "Customer Support Agent",

apps/sim/app/api/chat/[identifier]/route.ts

@@ -180,6 +180,8 @@ export const POST = withRouteHandler(
       const preprocessResult = await preprocessExecution({
         workflowId: deployment.workflowId,
         userId: deployment.userId,
+        // Whoever deployed this chat, not whoever is talking to it.
+        userIdIsStoredReference: true,
         triggerType: 'chat',
         executionId,
         requestId,
@@ -273,7 +275,16 @@ export const POST = withRouteHandler(
 
         const workflowForExecution = {
           id: deployment.workflowId,
-          userId: deployment.userId,
+          /**
+           * The workflow owner, not the chat's creator: `executeWorkflow` reads this
+           * one field to set `workflowUserId`, the personal-environment fallback for
+           * runs with no identifiable caller. `chat.userId` records who deployed the
+           * chat and is never maintained as an execution identity — member removal
+           * reassigns `workflow.userId` to keep it an active workspace identity and
+           * has no equivalent for the chat row — so reading it here made deployed
+           * chat resolve a pointer that every other trigger had already repaired.
+           */
+          userId: workflowRecord.userId,
           workspaceId,
           isDeployed: workflowRecord?.isDeployed ?? false,
           variables: (workflowRecord?.variables as Record<string, unknown>) ?? undefined,

apps/sim/app/api/v1/logs/[id]/route.ts

@@ -51,7 +51,6 @@ export const GET = withRouteHandler(
         name: log.workflowName || 'Deleted Workflow',
         description: log.workflowDescription,
         folderId: log.workflowFolderId,
-        userId: log.workflowUserId,
         workspaceId: log.workflowWorkspaceId,
         createdAt: log.workflowCreatedAt,
         updatedAt: log.workflowUpdatedAt,

apps/sim/app/api/v2/logs/[runId]/route.test.ts

@@ -49,6 +49,7 @@ const log = {
   files: null,
   workflowName: 'Support Agent',
   workflowDescription: null,
+  executedByEmail: 'actor@example.com',
   workflowOwnerEmail: 'owner@example.com',
   workflowWorkspaceId: 'workspace-1',
   workflowCreatedAt: new Date('2026-01-01T00:00:00Z'),
@@ -86,8 +87,16 @@ describe('GET /api/v2/logs/[runId]', () => {
     const body = await response.json()
 
     expect(response.status).toBe(200)
+    /**
+     * The two identities are deliberately different people here. `ownerEmail` is
+     * deprecated but still a required field of the published schema, so it must
+     * keep resolving from the workflow owner rather than quietly aliasing to the
+     * executing identity — dropping its own join would make both read the same
+     * and break every client still on it.
+     */
     expect(body.data).toMatchObject({
       runId: 'run-1',
+      executedByEmail: 'actor@example.com',
       workflow: { folderPath: '/agents', ownerEmail: 'owner@example.com' },
       finalOutput: { ok: true },
     })

apps/sim/app/api/v2/logs/[runId]/route.ts

@@ -49,11 +49,13 @@ export const GET = defineV2JsonRoute({
       endedAt: log.endedAt ? log.endedAt.toISOString() : null,
       totalDurationMs: log.totalDurationMs,
       files: projectLogFiles(log),
+      executedByEmail: log.executedByEmail,
       workflow: {
         id: log.workflowId,
         name: log.workflowName || 'Deleted Workflow',
         description: log.workflowDescription,
         folderPath: workflowFolderPath,
+        /** Deprecated in favour of the run-level `executedByEmail`. */
         ownerEmail: log.workflowOwnerEmail,
         workspaceId: log.workflowWorkspaceId,
         createdAt: log.workflowCreatedAt ? log.workflowCreatedAt.toISOString() : null,

apps/sim/app/api/v2/workflows/[workflowId]/execute/route.test.ts

@@ -218,6 +218,22 @@ function callPublicExecute(body: Record<string, unknown>, headers: Record<string
   return POST(req, { params: Promise.resolve({ workflowId: 'workflow-1' }) })
 }
 
+/**
+ * Queues the two reads the anonymous public path makes, in order: the workflow's
+ * public-API eligibility, then the workspace billing account it runs as. Keeping
+ * them together stops a caller queueing only the first and getting an
+ * indistinguishable 401 from the missing second.
+ */
+function queuePublicWorkflowReads(
+  overrides: { isPublicApi?: boolean; isDeployed?: boolean; billedAccountUserId?: string } = {}
+) {
+  const { isPublicApi = true, isDeployed = true, billedAccountUserId = 'billing-1' } = overrides
+  dbChainMockFns.limit.mockResolvedValueOnce([
+    { isPublicApi, isDeployed, workspaceId: 'workspace-1' },
+  ])
+  dbChainMockFns.limit.mockResolvedValueOnce([{ billedAccountUserId }])
+}
+
 function authenticatePersonalKey() {
   mockAuthenticateV2ApiKey.mockResolvedValue({
     principal: { kind: 'personal_api_key', userId: 'actor-1', keyId: 'key-1' },
@@ -759,9 +775,7 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
 
   it('runs the anonymous public path sync but refuses async', async () => {
     dbChainMockFns.limit.mockReset()
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
 
     const okRes = await callPublicExecute({ input: {} })
     expect(okRes.status).toBe(200)
@@ -774,18 +788,14 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
       expect.objectContaining({ rateLimitCounter: 'sync' })
     )
 
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
     const asyncRes = await callPublicExecute({ input: {}, async: true })
     expect(asyncRes.status).toBe(400)
   })
 
   it('never permits manual execution on the anonymous public path', async () => {
     dbChainMockFns.limit.mockReset()
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
 
     const response = await callPublicExecute({ run: { source: 'manual' } })
 
@@ -798,9 +808,7 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
 
   it('returns not found when a public workflow disappears before authorization', async () => {
     dbChainMockFns.limit.mockReset()
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
     mockAuthorize.mockResolvedValueOnce({
       allowed: false,
       status: 404,
@@ -837,7 +845,7 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
   it('401s non-public workflows without a key', async () => {
     dbChainMockFns.limit.mockReset()
     dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: false, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
+      { isPublicApi: false, isDeployed: true, workspaceId: 'workspace-1' },
     ])
 
     const res = await callPublicExecute({ input: {} })
@@ -870,9 +878,7 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
     expect(keyedBody.error.message).toContain('Maximum workflow call chain depth (25) exceeded')
 
     dbChainMockFns.limit.mockReset()
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
     const anonymous = await callPublicExecute({ input: {} }, { 'X-Sim-Via': maxChain })
     expect(anonymous.status).toBe(409)
     expect((await anonymous.json()).error.code).toBe('CONFLICT')
@@ -891,9 +897,7 @@ describe('POST /api/v2/workflows/[workflowId]/execute', () => {
     ])
 
     dbChainMockFns.limit.mockReset()
-    dbChainMockFns.limit.mockResolvedValueOnce([
-      { isPublicApi: true, isDeployed: true, userId: 'owner-1', workspaceId: 'workspace-1' },
-    ])
+    queuePublicWorkflowReads()
     const anonymous = await callPublicExecute({ input: {} }, { 'X-Sim-Via': 'wf-a, wf-b' })
     expect(anonymous.status).toBe(200)
     expect(mockExecuteWorkflowCore.mock.calls[1][0].snapshot.metadata.callChain).toEqual([

apps/sim/app/api/v2/workflows/[workflowId]/execute/route.ts

@@ -21,6 +21,7 @@ import {
   v2RateLimits,
 } from '@/lib/api/server/routes'
 import type { V2ApiKeyPrincipal } from '@/lib/api/server/routes/v2-api-key-auth'
+import { getWorkspaceBilledAccountUserId } from '@/lib/billing/core/billing-attribution'
 import { tryAdmit } from '@/lib/core/admission/gate'
 import { ADMISSION_ERROR_DESCRIPTOR } from '@/lib/core/admission/transient-failure'
 import type { ForbiddenDetailCode } from '@/lib/core/application'
@@ -173,7 +174,6 @@ export const POST = withRouteHandler(
         .select({
           isPublicApi: workflowTable.isPublicApi,
           isDeployed: workflowTable.isDeployed,
-          userId: workflowTable.userId,
           workspaceId: workflowTable.workspaceId,
         })
         .from(workflowTable)
@@ -183,15 +183,27 @@ export const POST = withRouteHandler(
       if (!wf?.isPublicApi || !wf.isDeployed || !wf.workspaceId) {
         return v2Error('UNAUTHORIZED', 'Unauthorized')
       }
+      /**
+       * An anonymous public-API call has no caller, so it acts as the workspace
+       * billing account — the identity preprocessing elects for exactly this
+       * case. The workflow owner is only the personal-variable fallback, and a
+       * public run resolves no personal variables at all, so gating on the
+       * owner's governance config and workspace read would fail a public
+       * endpoint the moment that stored pointer's access lapsed.
+       */
+      const billedAccountUserId = await getWorkspaceBilledAccountUserId(wf.workspaceId)
+      if (!billedAccountUserId) {
+        return v2Error('UNAUTHORIZED', 'Unauthorized')
+      }
       try {
-        await validatePublicApiAllowed(wf.userId, wf.workspaceId)
+        await validatePublicApiAllowed(billedAccountUserId, wf.workspaceId)
       } catch (err) {
         if (err instanceof PublicApiNotAllowedError) {
           return v2Error('UNAUTHORIZED', 'Unauthorized')
         }
         throw err
       }
-      publicApiUserId = wf.userId
+      publicApiUserId = billedAccountUserId
       isPublicApiAccess = true
     }
 
@@ -343,7 +355,7 @@ export const POST = withRouteHandler(
         }
       } else {
         if (!publicApiUserId) {
-          throw new Error('Public workflow execution is missing its owner')
+          throw new Error('Public workflow execution is missing its workspace billing account')
         }
         const workflowAuthorization = await authorizeWorkflowByWorkspacePermission({
           workflowId,

apps/sim/app/api/workflows/[id]/execute/route.async.test.ts

@@ -38,6 +38,7 @@ import {
 
 const {
   mockAssertBillingAttributionSnapshot,
+  mockGetWorkspaceBilledAccountUserId,
   mockClaimExecutionId,
   mockClaimWorkflowToolExecution,
   mockCheckNeedsRedeployment,
@@ -89,12 +90,14 @@ const {
   mockReleaseExecutionSlot: vi.fn(),
   mockReleaseWorkflowToolExecutionClaim: vi.fn(),
   mockRequireBillingAttributionHeader: vi.fn(),
+  mockGetWorkspaceBilledAccountUserId: vi.fn().mockResolvedValue('billing-1'),
   mockShouldExecuteInline: vi.fn().mockReturnValue(false),
   mockValidatePublicApiAllowed: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/billing-attribution', () => ({
   assertBillingAttributionSnapshot: mockAssertBillingAttributionSnapshot,
+  getWorkspaceBilledAccountUserId: mockGetWorkspaceBilledAccountUserId,
   requireBillingAttributionHeader: mockRequireBillingAttributionHeader,
 }))
 
@@ -345,7 +348,6 @@ function configureExecutionCaller(caller: ExecutionCallerCase, requestCount = 1)
       {
         isPublicApi: true,
         isDeployed: true,
-        userId: 'owner-1',
         workspaceId: 'workspace-1',
       },
     ])

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -20,6 +20,7 @@ import { releaseExecutionSlot } from '@/lib/billing/calculations/usage-reservati
 import {
   assertBillingAttributionSnapshot,
   type BillingAttributionSnapshot,
+  getWorkspaceBilledAccountUserId,
   requireBillingAttributionHeader,
 } from '@/lib/billing/core/billing-attribution'
 import {
@@ -596,7 +597,6 @@ async function handleExecutePost(
         .select({
           isPublicApi: workflowTable.isPublicApi,
           isDeployed: workflowTable.isDeployed,
-          userId: workflowTable.userId,
           workspaceId: workflowTable.workspaceId,
         })
         .from(workflowTable)
@@ -607,16 +607,29 @@ async function handleExecutePost(
         return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
       }
 
+      /**
+       * An anonymous public-API call has no caller, so it acts as the workspace
+       * billing account — the identity preprocessing elects for exactly this
+       * case. The workflow owner is only the personal-variable fallback, and a
+       * public run resolves no personal variables at all, so gating on the
+       * owner's governance config would fail a public endpoint the moment that
+       * stored pointer's access lapsed.
+       */
+      const billedAccountUserId = await getWorkspaceBilledAccountUserId(wf.workspaceId)
+      if (!billedAccountUserId) {
+        return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+      }
+
       try {
-        await validatePublicApiAllowed(wf.userId, wf.workspaceId)
+        await validatePublicApiAllowed(billedAccountUserId, wf.workspaceId)
       } catch (err) {
         if (err instanceof PublicApiNotAllowedError) {
           return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
         }
         throw err
       }
 
-      userId = wf.userId
+      userId = billedAccountUserId
       isPublicApiAccess = true
     } else {
       userId = auth.userId