@@ -351,23 +351,26 @@ describe('buildIntegrationToolSchemas', () => {
 })
 
 describe('buildCopilotRequestPayload', () => {
-  it.each([true, false])('passes server-authorized dashboard availability: %s', async (enabled) => {
-    const principal = { kind: 'session' as const, userId: 'actor' }
-    mockDashboardAvailability.mockResolvedValueOnce(enabled)
-    const payload = await buildCopilotRequestPayload(
-      {
-        message: 'Show my dashboard',
-        userId: 'actor',
-        userMessageId: 'message-1',
-        workspaceId: 'workspace-1',
-        principal,
-        mode: 'agent',
-        model: '',
-      },
-      { selectedModel: '' }
-    )
-    expect(payload.dashboardsEnabled).toBe(enabled)
-  })
+  it.each([true, false])(
+    'grants the dashboards entitlement from server availability: %s',
+    async (enabled) => {
+      const principal = { kind: 'session' as const, userId: 'actor' }
+      mockDashboardAvailability.mockResolvedValueOnce(enabled)
+      const payload = await buildCopilotRequestPayload(
+        {
+          message: 'Show my dashboard',
+          userId: 'actor',
+          userMessageId: 'message-1',
+          workspaceId: 'workspace-1',
+          principal,
+          mode: 'agent',
+          model: '',
+        },
+        { selectedModel: '' }
+      )
+      expect(payload.entitlements).toEqual(enabled ? ['dashboards'] : [])
+    }
+  )
 
   beforeEach(() => {
     mockTrackChatUpload.mockResolvedValue({ displayName: 'payroll.xlsx' })
@@ -606,7 +609,6 @@ describe('buildCopilotRequestPayload', () => {
     for (const legacy of [
       'workspaceContext',
       'vfs',
-      'entitlements',
       'userMetadata',
       'userPermission',
       'model',
 
@@ -8,8 +8,6 @@ import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
 import { isPaid } from '@/lib/billing/plan-helpers'
 import type { BlockVisibilityState } from '@/lib/core/config/block-visibility'
 import { isHosted, isLiveEnterpriseSearchEnabled } from '@/lib/core/config/env-flags'
-import { readDashboardAvailability } from '@/lib/dashboards/application/availability'
-import { isDashboardsEnabled } from '@/lib/dashboards/feature-flag'
 import { isOAuthServiceDeploymentAvailable } from '@/lib/integrations/availability.server'
 import {
   type IntegrationGateConfig,
@@ -31,6 +29,7 @@ import {
 import type { AssistantImageContent } from '@/lib/mothership/chat/assistant-images'
 import { buildUploadedFileContext } from '@/lib/mothership/chat/upload-context'
 import { buildWorkspaceInventory } from '@/lib/mothership/chat/workspace-inventory'
+import { computeEntitlements } from '@/lib/mothership/entitlements'
 import type { AssistantSearchLevel } from '@/lib/mothership/generated/assistant'
 import type { ChatRequest, ModelSelection } from '@/lib/mothership/generated/protocol'
 import type { VfsSnapshotV1 } from '@/lib/mothership/generated/vfs-snapshot-v1'
@@ -444,18 +443,15 @@ export async function buildCopilotRequestPayload(
     !isAssistant && params.principal && params.workspaceId
       ? await buildWorkspaceInventory(params.principal, params.workspaceId)
       : undefined
-  const dashboardsEnabled =
-    !isAssistant &&
-    (params.organizationId
-      ? await isDashboardsEnabled(params.organizationId)
-      : params.workspaceId && params.principal
-        ? await readDashboardAvailability.execute({
-            principal: params.principal,
-            input: { workspaceId: params.workspaceId },
-          })
-        : false)
+  const entitlements = isAssistant
+    ? []
+    : await computeEntitlements({
+        principal: params.principal,
+        workspaceId: params.workspaceId,
+        organizationId: params.organizationId,
+      })
   return {
-    dashboardsEnabled,
+    entitlements,
     message,
     ...(!isAssistant && workflowId ? { workflowId } : {}),
     ...(params.workspaceId ? { workspaceId: params.workspaceId } : {}),
 
@@ -0,0 +1,39 @@
+import type { Principal } from '@sim/auth/principal'
+import { readDashboardAvailability } from '@/lib/dashboards/application/availability'
+import { isDashboardsEnabled } from '@/lib/dashboards/feature-flag'
+import { ENTITLEMENTS, type Entitlement } from '@/lib/mothership/generated/protocol'
+
+/** The owner of one chat turn: exactly one of a workspace or an organization. */
+export interface EntitlementOwner {
+  principal?: Principal
+  workspaceId?: string
+  organizationId?: string
+}
+
+/**
+ * Entitlements are gated capabilities sent to Mothership as the chat payload's
+ * `entitlements` list. The worker hides the matching commands, skills and prompt
+ * sections when one is absent, so an organization without the feature never hears of it.
+ *
+ * Adding an entitlement:
+ * 1. Worker: add the name to `ENTITLEMENTS` in `packages/contracts/src/protocol.ts`, run
+ *    `bun run contracts:sync`, then declare it on the gated surfaces (`entitlement` on a
+ *    command spec, `entitlement:` frontmatter on a skill, or an `entitled()` prompt section).
+ * 2. Here: add an evaluator. Every payload site picks it up through `buildCopilotRequestPayload`.
+ * 3. Keep enforcement in Sim. The payload is forgeable, so the operation behind the gated
+ *    surface must re-check the same predicate when it runs.
+ */
+const EVALUATORS: Record<Entitlement, (owner: EntitlementOwner) => Promise<boolean>> = {
+  [ENTITLEMENTS.dashboards]: async ({ principal, workspaceId, organizationId }) => {
+    if (organizationId) return isDashboardsEnabled(organizationId)
+    if (!workspaceId || !principal) return false
+    return readDashboardAvailability.execute({ principal, input: { workspaceId } })
+  },
+}
+
+/** The entitlements Sim grants a turn's owner, evaluated fresh for every turn. */
+export async function computeEntitlements(owner: EntitlementOwner): Promise<Entitlement[]> {
+  const names = Object.values(ENTITLEMENTS)
+  const granted = await Promise.all(names.map((name) => EVALUATORS[name](owner)))
+  return names.filter((_, index) => granted[index])
+}
@@ -130,6 +130,17 @@ export const DesktopContextSchema = z.object({
 });
 export type DesktopContext = z.infer<typeof DesktopContextSchema>;
 
+/**
+ * Capabilities Sim computes for a turn's owner from organization flags, plan and ownership.
+ * The worker hides a gated command, skill or prompt section when its entitlement is absent.
+ * This only controls what the agent is told about: Sim re-checks every operation, because
+ * the list travels in a forgeable payload. The wire accepts any name, so Sim can add one
+ * before the worker learns it.
+ */
+export const ENTITLEMENTS = { dashboards: "dashboards" } as const;
+export type Entitlement = (typeof ENTITLEMENTS)[keyof typeof ENTITLEMENTS];
+export const Entitlements = z.array(z.string().min(1).max(64)).max(32);
+
 export const ChatPayloadSchema = z
   .strictObject({
     desktop: DesktopContextSchema.optional(),
@@ -152,7 +163,7 @@ export const ChatPayloadSchema = z
     /** Workflow-scoped chats (the workflow-page copilot): the agent anchors to this workflow. */
     workflowId: z.string().optional(),
     integrationCatalog: IntegrationCatalogContext.optional(),
-    dashboardsEnabled: z.boolean().optional(),
+    entitlements: Entitlements.default([]),
     /** Accepted for wire compatibility with current sim builds; unused — the CLI now
      * executes on the sim side under sim's own authentication, so no credential crosses. */
     delegationToken: z.string().optional(),
@@ -263,7 +274,8 @@ export interface ChatRequest extends StreamResponseReceipt {
   workflowId?: string | undefined;
   /** Authorized discovery selectors; schemas stay in Sim's catalog. */
   integrationCatalog?: IntegrationCatalogContext | undefined;
-  dashboardsEnabled?: boolean | undefined;
+  /** Capabilities Sim computed for this turn's owner; see {@link ENTITLEMENTS}. */
+  entitlements?: string[] | undefined;
   /** Deprecated: unused since the CLI moved to sim-side in-process execution (no
    * credential crosses the wire); accepted so current senders keep validating. */
   delegationToken?: string | undefined;