@@ -1,6 +1,8 @@
 import { useMemo, useSyncExternalStore } from 'react'
 import { isBrowserAgentAvailable } from '@/lib/browser-agent/transport'
 import { subscribeDesktopPreferences } from '@/lib/desktop'
+import { isBlockTypePermittedByAllowlist } from '@/lib/permission-groups/block-access'
+import { intersectAccessControlAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { isTerminalAvailable } from '@/lib/terminal/transport'
 import type { AvailableItem } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/resource-folder-tree'
 import {
@@ -10,9 +12,14 @@ import {
 import type { MothershipResourceType } from '@/app/workspace/[workspaceId]/home/types'
 import { formatDate } from '@/app/workspace/[workspaceId]/logs/utils'
 import { useFeatureFlag } from '@/app/workspace/[workspaceId]/providers/feature-flags-provider'
-import { listIntegrationsByPopularity } from '@/blocks/integration-matcher'
+import {
+  type IntegrationDescriptor,
+  listIntegrationsByPopularity,
+} from '@/blocks/integration-matcher'
+import { useUserPermissionConfig } from '@/ee/access-control/hooks/permission-groups'
 import { useWorkspaceDashboard } from '@/hooks/queries/dashboards'
 import { useFolders } from '@/hooks/queries/folders'
+import { useIntegrationAvailability } from '@/hooks/queries/integration-availability'
 import { useKnowledgeBasesQuery } from '@/hooks/queries/kb/knowledge'
 import { useLogsList } from '@/hooks/queries/logs'
 import { useMothershipChats } from '@/hooks/queries/mothership-chats'
@@ -93,6 +100,7 @@ interface UseAvailableResourcesOptions {
 
 /** Stable identity for the disabled result, so downstream memos never bust. */
 const NO_RESOURCE_GROUPS: AvailableItemsByType[] = []
+const NO_INTEGRATIONS: readonly IntegrationDescriptor[] = []
 
 const LOG_DROPDOWN_LIMIT = 50
 
@@ -178,6 +186,29 @@ export function useAvailableResources(
   const { data: tasks, isPending: tasksPending } = useMothershipChats(workspaceId, {
     enabled: enabled && Boolean(workspaceId),
   })
+  const integrationsIncluded = !excludeTypes?.includes('integration')
+  const { data: permissionConfig, isPending: permissionConfigPending } = useUserPermissionConfig(
+    enabled && integrationsIncluded && workspaceId ? workspaceId : undefined
+  )
+  const { data: integrationAvailability, isPending: integrationAvailabilityPending } =
+    useIntegrationAvailability()
+
+  /**
+   * Integrations this workspace's policy permits: the viewer's permission group
+   * intersected with the deployment allowlist. Fails closed — nothing is offered
+   * until both have loaded — because the server drops a mention of an
+   * integration either policy disallows.
+   */
+  const permittedIntegrations = useMemo(() => {
+    if (!permissionConfig || !integrationAvailability) return NO_INTEGRATIONS
+    const allowlist = intersectAccessControlAllowlists(
+      permissionConfig.config?.allowedIntegrations ?? null,
+      integrationAvailability.allowedIntegrations
+    )
+    return listIntegrationsByPopularity().filter((integration) =>
+      isBlockTypePermittedByAllowlist(allowlist, integration.blockType)
+    )
+  }, [permissionConfig, integrationAvailability])
   const { data: logsData, isPending: logsPending } = useLogsList(
     workspaceId,
     LOG_DROPDOWN_FILTERS,
@@ -208,7 +239,8 @@ export function useAvailableResources(
           (!excludeTypes?.includes('knowledgebase') && knowledgeBaseFoldersPending))) ||
       fileFoldersPending ||
       tasksPending ||
-      logsPending)
+      logsPending ||
+      (integrationsIncluded && (permissionConfigPending || integrationAvailabilityPending)))
 
   const groups = useMemo(() => {
     if (!enabled) return NO_RESOURCE_GROUPS
@@ -279,7 +311,7 @@ export function useAvailableResources(
       },
       {
         type: 'integration' as const,
-        items: listIntegrationsByPopularity().map((integration) => ({
+        items: permittedIntegrations.map((integration) => ({
           id: integration.blockType,
           name: integration.name,
           iconComponent: integration.icon,
@@ -355,6 +387,7 @@ export function useAvailableResources(
     knowledgeBases,
     tasks,
     logs,
+    permittedIntegrations,
     excludeTypes,
     dashboardsEnabled,
     testsEnabled,
 
@@ -33,6 +33,22 @@ describe('organization mention inventory', () => {
     expect(result.groups[1].items).toEqual([{ id: 'slack', name: 'Slack' }])
     expect(result.isHydrating).toBe(false)
   })
+  it('offers an integration only when every workspace policy permits it', () => {
+    const withIntegrations = (ids: string[]) => ({
+      ...inventory,
+      groups: [{ type: 'integration' as const, items: ids.map((id) => ({ id, name: id })) }],
+    })
+    const result = mergeOrganizationResourceInventories(
+      [
+        { id: 'sales', name: 'Sales' },
+        { id: 'finance', name: 'Finance' },
+      ],
+      { sales: withIntegrations(['slack', 'gmail_v2']), finance: withIntegrations(['gmail_v2']) }
+    )
+    expect(result.groups).toEqual([
+      { type: 'integration', items: [{ id: 'gmail_v2', name: 'gmail_v2' }] },
+    ])
+  })
   it('keeps mention confirmation pending until every accessible workspace settles', () => {
     expect(
       mergeOrganizationResourceInventories([{ id: 'sales', name: 'Sales' }], {}).isHydrating
 
@@ -51,8 +51,14 @@ export function mergeOrganizationResourceInventories(
     })
     for (const group of inventory.groups) {
       if (group.type === 'browser' || group.type === 'terminal') continue
-      // Integration definitions are global and do not belong to a workspace.
-      if (group.type === 'integration' && byType.has(group.type)) continue
+      // Integrations are not workspace-owned, but a permission group can target
+      // individual workspaces, so one is offered only where every workspace permits it.
+      const integrations = group.type === 'integration' ? byType.get(group.type) : undefined
+      if (integrations) {
+        const permittedHere = new Set(group.items.map((item) => item.id))
+        integrations.items = integrations.items.filter((item) => permittedHere.has(item.id))
+        continue
+      }
       let target = byType.get(group.type)
       if (!target) {
         target = { type: group.type, items: [] }
 
@@ -1,6 +1,6 @@
 'use client'
 
-import { type ComponentType, useCallback, useMemo, useRef } from 'react'
+import { type ComponentType, useCallback, useMemo, useRef, useState } from 'react'
 import {
   ChevronDown,
   ChipInput,
@@ -11,6 +11,7 @@ import {
   DropdownMenuTrigger,
   Search,
 } from '@sim/emcn'
+import { Lock } from '@sim/emcn/icons'
 import { useParams } from 'next/navigation'
 import { useQueryStates } from 'nuqs'
 import {
@@ -37,7 +38,11 @@ import {
   SettingsQueryErrorState,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
-import { PermissionAccessBoundary } from '@/ee/access-requests/components/permission-access-boundary'
+import {
+  PermissionAccessBoundary,
+  useWorkspaceAccessRequestFeatures,
+} from '@/ee/access-requests/components/permission-access-boundary'
+import { RequestAccessModal } from '@/ee/access-requests/components/request-access-action'
 import { useWorkspaceCredentials, type WorkspaceCredential } from '@/hooks/queries/credentials'
 import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
@@ -74,6 +79,8 @@ interface IntegrationItemProps {
   description?: string | null
   icon: ComponentType<{ className?: string }>
   unavailable?: boolean
+  /** Set for an integration the viewer's policy restricts but lets them request. */
+  onRequestAccess?: () => void
 }
 
 function IntegrationItem({
@@ -84,7 +91,9 @@ function IntegrationItem({
   description,
   icon: Icon,
   unavailable = false,
+  onRequestAccess,
 }: IntegrationItemProps) {
+  const restricted = onRequestAccess !== undefined
   return (
     <SettingsResourceRow
       iconVariant='custom'
@@ -95,9 +104,15 @@ function IntegrationItem({
           ? 'Unavailable in this deployment. Contact your administrator.'
           : description || undefined
       }
-      href={`/workspace/${workspaceId}/integrations/${slug}`}
-      clickLabel={`Open ${name}`}
-      navigable={!unavailable}
+      badge={
+        restricted ? (
+          <Lock className='size-[14px] text-[var(--text-icon)]' aria-hidden />
+        ) : undefined
+      }
+      href={restricted ? undefined : `/workspace/${workspaceId}/integrations/${slug}`}
+      onClick={onRequestAccess}
+      clickLabel={restricted ? `Request access to ${name}` : `Open ${name}`}
+      navigable={!unavailable && !restricted}
       disabled={unavailable}
     />
   )
@@ -156,11 +171,14 @@ function IntegrationsContent() {
   const {
     integrationAvailability,
     isBlockPermitted,
+    isBlockRequestable,
     isIntegrationAvailabilityReady,
     isIntegrationAvailabilityFetching,
     integrationAvailabilityError,
     refetchIntegrationAvailability,
   } = usePermissionConfig()
+  const accessRequestsEnabled = useWorkspaceAccessRequestFeatures().data?.enabled === true
+  const [requestedIntegration, setRequestedIntegration] = useState<Integration | null>(null)
 
   const [{ category: urlCategory, search: urlSearchTerm }, setIntegrationFilters] = useQueryStates(
     integrationsParsers,
@@ -218,29 +236,33 @@ function IntegrationsContent() {
   }, [oauthCredentials])
 
   /**
-   * The catalog lists nothing until the deployment allowlist has loaded, so a
-   * pending or failed availability request never shows an integration the
-   * deployment's `ALLOWED_INTEGRATIONS` excludes.
+   * The catalog lists what the viewer's integration policy permits, plus — when
+   * access requests are on — what it restricts but lets them request, which
+   * renders as a locked row. It lists nothing until the deployment allowlist has
+   * loaded, so a pending or failed availability request never shows an
+   * integration the deployment's `ALLOWED_INTEGRATIONS` excludes.
    */
-  const permittedFeatured = useMemo(
-    () =>
-      isIntegrationAvailabilityReady
-        ? FEATURED_INTEGRATIONS.filter((integration) => isBlockPermitted(integration.type))
-        : [],
-    [isIntegrationAvailabilityReady, isBlockPermitted]
+  const isListed = useMemo(
+    () => (blockType: string) =>
+      isIntegrationAvailabilityReady &&
+      (isBlockPermitted(blockType) || (accessRequestsEnabled && isBlockRequestable(blockType))),
+    [isIntegrationAvailabilityReady, isBlockPermitted, accessRequestsEnabled, isBlockRequestable]
+  )
+
+  const listedFeatured = useMemo(
+    () => FEATURED_INTEGRATIONS.filter((integration) => isListed(integration.type)),
+    [isListed]
   )
 
-  const permittedCategorySections = useMemo(
+  const listedCategorySections = useMemo(
     () =>
-      isIntegrationAvailabilityReady
-        ? ALL_CATEGORY_SECTIONS.flatMap((section) => {
-            const integrations = section.integrations.filter((integration) =>
-              isBlockPermitted(integration.type)
-            )
-            return integrations.length > 0 ? [{ label: section.label, integrations }] : []
-          })
-        : [],
-    [isIntegrationAvailabilityReady, isBlockPermitted]
+      ALL_CATEGORY_SECTIONS.flatMap((section) => {
+        const integrations = section.integrations.filter((integration) =>
+          isListed(integration.type)
+        )
+        return integrations.length > 0 ? [{ label: section.label, integrations }] : []
+      }),
+    [isListed]
   )
 
   const setSelectedCategory = useCallback(
@@ -253,8 +275,8 @@ function IntegrationsContent() {
   const categoryOptions = [
     ALL_CATEGORY,
     ...(connectedItems.length > 0 ? [CONNECTED_LABEL] : []),
-    ...(permittedFeatured.length > 0 ? [FEATURED_LABEL] : []),
-    ...permittedCategorySections.map((section) => section.label),
+    ...(listedFeatured.length > 0 ? [FEATURED_LABEL] : []),
+    ...listedCategorySections.map((section) => section.label),
   ]
 
   /**
@@ -282,7 +304,7 @@ function IntegrationsContent() {
       integration.description.toLowerCase().includes(normalizedSearch)
 
     if (isFeaturedSelected) {
-      const items = permittedFeatured.filter(matchesSearch)
+      const items = listedFeatured.filter(matchesSearch)
       return items.length > 0 ? [{ label: FEATURED_LABEL, integrations: items }] : []
     }
 
@@ -291,11 +313,11 @@ function IntegrationsContent() {
 
     // Featured is a curated home-row pin: hide it during search so results
     // are not duplicated between the Featured section and the category list.
-    const featured = normalizedSearch ? [] : permittedFeatured.filter(matchesCategory)
+    const featured = normalizedSearch ? [] : listedFeatured.filter(matchesCategory)
     const featuredSection =
       featured.length > 0 ? [{ label: FEATURED_LABEL, integrations: featured }] : []
 
-    const categorySections = permittedCategorySections
+    const categorySections = listedCategorySections
       .filter((section) => isAllCategorySelected || section.label === selectedCategory)
       .map((section) => ({
         label: section.label,
@@ -305,8 +327,8 @@ function IntegrationsContent() {
 
     return [...featuredSection, ...categorySections]
   }, [
-    permittedFeatured,
-    permittedCategorySections,
+    listedFeatured,
+    listedCategorySections,
     isAllCategorySelected,
     isConnectedSelected,
     isFeaturedSelected,
@@ -349,6 +371,15 @@ function IntegrationsContent() {
   return (
     <div className='flex h-full flex-col bg-[var(--bg)]'>
       <IntegrationTabsHeader active='integrations' workspaceId={workspaceId} />
+      {requestedIntegration && accessRequestsEnabled && (
+        <RequestAccessModal
+          key={requestedIntegration.type}
+          scope={{ kind: 'workspace', workspaceId }}
+          target={{ kind: 'integration', id: requestedIntegration.type }}
+          label={requestedIntegration.name}
+          onClose={() => setRequestedIntegration(null)}
+        />
+      )}
       <div
         ref={scrollContainerRef}
         className='min-h-0 flex-1 overflow-y-auto px-6 [scrollbar-gutter:stable_both-edges]'
@@ -429,6 +460,11 @@ function IntegrationsContent() {
                       description={integration.description}
                       icon={Icon}
                       unavailable={integration.authType === 'oauth' && deploymentUnavailable}
+                      onRequestAccess={
+                        isBlockPermitted(integration.type)
+                          ? undefined
+                          : () => setRequestedIntegration(integration)
+                      }
                     />
                   )
                 })}
 
@@ -8,7 +8,10 @@ import {
   isDeploymentGatedIntegrationType,
   resolveIntegrationAvailabilityStateForVisibility,
 } from '@/lib/integrations/availability'
-import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import {
+  isBlockTypeAccessControlExempt,
+  isBlockTypePermittedByAllowlist,
+} from '@/lib/permission-groups/block-access'
 import {
   DEFAULT_PERMISSION_GROUP_CONFIG,
   type PermissionGroupConfig,
@@ -146,13 +149,11 @@ export function usePermissionConfig(): PermissionConfigResult {
     [envAllowlistData?.oauthServiceAvailability]
   )
 
-  const isBlockPermitted = useMemo(() => {
-    return (blockType: string) => {
-      if (isBlockTypeAccessControlExempt(blockType)) return true
-      if (allowedAccessControlTypes === null) return true
-      return allowedAccessControlTypes.has(resolveAccessControlBlockType(blockType.toLowerCase()))
-    }
-  }, [allowedAccessControlTypes])
+  const isBlockPermitted = useMemo(
+    () => (blockType: string) =>
+      isBlockTypePermittedByAllowlist(allowedAccessControlTypes, blockType),
+    [allowedAccessControlTypes]
+  )
 
   const isBlockAllowed = useMemo(() => {
     return (blockType: string) => {
 
@@ -43,6 +43,19 @@ export function isBlockTypeAccessControlExempt(blockType: string): boolean {
   return successor === blockType || successor === UNIVERSAL_ENTRY_POINT
 }
 
+/**
+ * Whether a resolved integration allowlist permits `blockType`. The allowlist is
+ * in the successor-resolved vocabulary `toAccessControlAllowlist` and
+ * `intersectAccessControlAllowlists` produce; `null` is unrestricted.
+ */
+export function isBlockTypePermittedByAllowlist(
+  allowlist: ReadonlySet<string> | null,
+  blockType: string
+): boolean {
+  if (allowlist === null || isBlockTypeAccessControlExempt(blockType)) return true
+  return allowlist.has(resolveAccessControlBlockType(blockType.toLowerCase()))
+}
+
 /**
  * Whether `blockType` is a row in the Access Control editor's allowlist
  * universe — the set the editor materializes an allowlist from and compares