@@ -1,4 +1,8 @@
 import { copilotHttpMock, copilotHttpMockFns } from '@sim/testing/mocks/copilot-http.mock'
+import {
+  mothershipAsyncRunsMock,
+  mothershipAsyncRunsMockFns,
+} from '@sim/testing/mocks/mothership-async-runs.mock'
 import {
   mothershipEnvironmentContextMock,
   mothershipEnvironmentContextMockFns,
@@ -16,6 +20,8 @@ vi.mock('@/lib/mothership/request/http', () => copilotHttpMock)
 
 vi.mock('@/lib/mothership/environment-context', () => mothershipEnvironmentContextMock)
 
+vi.mock('@/lib/mothership/async-runs/repository', () => mothershipAsyncRunsMock)
+
 vi.mock('@/lib/mothership/tool-executor', () => ({
   ensureHandlersRegistered: vi.fn(),
   toolRequiresApprovalLane: mockToolRequiresApprovalLane,
@@ -41,6 +47,7 @@ const { mockCheckInternalApiKey } = copilotHttpMockFns
 
 const mockPrepareEnvironmentContext =
   mothershipEnvironmentContextMockFns.mockPrepareCopilotEnvironmentContext
+const { mockGetRunSecretAuthority } = mothershipAsyncRunsMockFns
 
 function makeRequest(body: Record<string, unknown>): Request {
   return new Request('http://localhost/api/copilot/tools/execute', {
@@ -153,4 +160,35 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
       expect(body.error).toContain('checkpoint lane')
     })
   })
+  /**
+   * Go's body cannot carry the turn's secret authority — the turn payload never did — so a
+   * context rebuilt from it alone read as "every secret, as the body's user" for a turn that
+   * was admitted with less.
+   */
+  describe('secret authority', () => {
+    it("hands the tool the turn's re-derived authority, not the permissive default", async () => {
+      const admitted = {
+        secretMountPolicy: { secretScope: 'selected' as const, mountedSecrets: ['STRIPE_KEY'] },
+        secretActorUserId: null,
+      }
+      mockGetRunSecretAuthority.mockResolvedValueOnce(admitted)
+      mockHandler.mockResolvedValue({ success: true, output: { ran: true } })
+
+      await POST(
+        makeRequest({
+          ...BASE_BODY,
+          toolName: 'run_function',
+          params: { code: 'return 1', secrets: ['STRIPE_KEY'] },
+          messageId: 'msg-admitted-authority',
+        }) as never
+      )
+
+      expect(mockGetRunSecretAuthority).toHaveBeenCalledWith({
+        streamId: 'msg-admitted-authority',
+        userId: BASE_BODY.userId,
+        chatId: BASE_BODY.chatId,
+      })
+      expect(mockHandler.mock.calls[0][1]).toMatchObject(admitted)
+    })
+  })
 })
@@ -4,6 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { copilotToolExecuteInternalBodySchema } from '@/lib/api/contracts/copilot'
 import { validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getRunSecretAuthority } from '@/lib/mothership/async-runs/repository'
 import { toolResultForModel } from '@/lib/mothership/chat/sim-key-redaction'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
 import { MothershipStreamV1ToolOutcome } from '@/lib/mothership/generated/mothership-stream-v1'
@@ -19,6 +20,7 @@ import {
 } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { handleResourceSideEffects } from '@/lib/mothership/request/tools/resources'
 import type { ToolCallResult } from '@/lib/mothership/request/types'
+import { NO_SECRET_AUTHORITY, type TurnSecretAuthority } from '@/lib/mothership/secret-mount-policy'
 import { ensureHandlersRegistered, toolRequiresApprovalLane } from '@/lib/mothership/tool-executor'
 import { executeTool } from '@/lib/mothership/tool-executor/executor'
 import { TOOL_EFFECT_PHASE } from '@/lib/mothership/tool-executor/types'
@@ -32,43 +34,58 @@ const logger = createLogger('CopilotToolExecuteInternalAPI')
  * egress projection, exactly as the request-lifecycle registry accumulates
  * across a turn. Keyed by the turn (messageId) so one background lane shares
  * one registry; TTL-evicted since nothing signals turn end on this route.
+ *
+ * The turn's secret authority, which Go's body cannot carry, is cached beside it
+ * (see {@link getRunSecretAuthority}).
  */
 const TURN_REGISTRY_TTL_MS = 10 * 60 * 1000
 const TURN_REGISTRY_CACHE_MAX = 256
 const turnRegistryCache = new Map<
   string,
-  { registry: ResolvedSecretTraceRegistry; expiresAt: number }
+  {
+    registry: ResolvedSecretTraceRegistry
+    secretAuthority: TurnSecretAuthority
+    expiresAt: number
+  }
 >()
 
-async function getTurnEgressRegistry(
+async function getTurnToolContext(
   userId: string,
   workspaceId: string | undefined,
+  chatId: string | undefined,
   messageId: string | undefined,
   requestMode?: string,
   organizationId?: string
-): Promise<ResolvedSecretTraceRegistry> {
-  const key = `${userId}\u0000${workspaceId ?? ''}\u0000${organizationId ?? ''}\u0000${messageId ?? ''}\u0000${requestMode ?? ''}`
+): Promise<{ registry: ResolvedSecretTraceRegistry; secretAuthority: TurnSecretAuthority }> {
+  const key = `${userId}\u0000${workspaceId ?? ''}\u0000${organizationId ?? ''}\u0000${chatId ?? ''}\u0000${messageId ?? ''}\u0000${requestMode ?? ''}`
   const now = Date.now()
   const hit = turnRegistryCache.get(key)
   if (hit && hit.expiresAt > now) {
     hit.expiresAt = now + TURN_REGISTRY_TTL_MS
-    return hit.registry
+    return hit
   }
-  const environmentContext = await prepareCopilotEnvironmentContext(userId, workspaceId, {
-    includeSecrets: requestMode !== 'assistant',
-  })
+  const [environmentContext, secretAuthority] = await Promise.all([
+    prepareCopilotEnvironmentContext(userId, workspaceId, {
+      includeSecrets: requestMode !== 'assistant',
+    }),
+    chatId && messageId
+      ? getRunSecretAuthority({ streamId: messageId, userId, chatId })
+      : NO_SECRET_AUTHORITY,
+  ])
   for (const [cachedKey, cached] of turnRegistryCache) {
     if (cached.expiresAt <= now) turnRegistryCache.delete(cachedKey)
   }
   if (turnRegistryCache.size >= TURN_REGISTRY_CACHE_MAX) {
     const oldest = turnRegistryCache.keys().next().value
     if (oldest !== undefined) turnRegistryCache.delete(oldest)
   }
-  turnRegistryCache.set(key, {
+  const entry = {
     registry: environmentContext.resolvedSecretTraceRegistry,
+    secretAuthority,
     expiresAt: now + TURN_REGISTRY_TTL_MS,
-  })
-  return environmentContext.resolvedSecretTraceRegistry
+  }
+  turnRegistryCache.set(key, entry)
+  return entry
 }
 
 // POST /api/copilot/tools/execute — internal (Go → Sim) in-band execution of
@@ -153,14 +170,18 @@ export const POST = withRouteHandler((request: NextRequest) =>
 
       let toolRegistry: ResolvedSecretTraceRegistry
       let turnRegistry: ResolvedSecretTraceRegistry
+      let secretAuthority: TurnSecretAuthority
       try {
-        turnRegistry = await getTurnEgressRegistry(
+        const turn = await getTurnToolContext(
           userId,
           workspaceId,
+          chatId,
           messageId,
           requestMode,
           organizationId
         )
+        turnRegistry = turn.registry
+        secretAuthority = turn.secretAuthority
         toolRegistry = turnRegistry.forkForInputPaths([])
       } catch (err) {
         /**
@@ -218,6 +239,8 @@ export const POST = withRouteHandler((request: NextRequest) =>
           assistantSearch,
           targetWorkspaceId,
           resolvedSecretTraceRegistry: toolRegistry,
+          secretMountPolicy: secretAuthority.secretMountPolicy,
+          secretActorUserId: secretAuthority.secretActorUserId,
         })
         const projection = inspectToolResultForCopilot(result, toolRegistry, toolName)
         const projected = projection.result
 
@@ -30,6 +30,8 @@ import {
   type SQL,
   sql,
 } from 'drizzle-orm'
+import { z } from 'zod'
+import { secretMountPolicySchema } from '@/lib/api/contracts/secret-mount-policy'
 import { type ResourceOwner, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
@@ -65,6 +67,11 @@ import {
 import type { BillingAdmission } from '@/lib/mothership/request/lifecycle/recovery-config'
 import { markSpanForError } from '@/lib/mothership/request/otel'
 import { sealClientToolSettlement } from '@/lib/mothership/request/tools/client-completion-seal.server'
+import {
+  DEFAULT_SECRET_MOUNT_POLICY,
+  NO_SECRET_AUTHORITY,
+  type TurnSecretAuthority,
+} from '@/lib/mothership/secret-mount-policy'
 import {
   type DesktopToolClaimOwner,
   isDesktopToolCall,
@@ -573,6 +580,49 @@ export async function recordRunBillingAdmission(
   )
 }
 
+const recordedSecretAuthoritySchema = z.object({
+  secretMountPolicy: secretMountPolicySchema,
+  secretActorUserId: z.string().nullable(),
+})
+
+/**
+ * The secret authority a turn was admitted with, for a lane that rebuilds its tool context from
+ * Go's request instead of inheriting the turn's. Headless runs record it at admission; an
+ * interactive chat narrows it only in assistant mode, so its saved request decides. Anything
+ * else — no run, another user's or chat's run, an unrecorded headless run — mounts nothing.
+ */
+export async function getRunSecretAuthority(input: {
+  streamId: string
+  userId: string
+  chatId: string
+}): Promise<TurnSecretAuthority> {
+  const [run] = await db
+    .select({
+      chatId: copilotRuns.chatId,
+      recorded: sql<unknown>`${copilotRuns.requestContext}->'secretAuthority'`,
+      recoveryKind: sql<string | null>`${copilotRuns.requestContext}->'recovery'->>'kind'`,
+      requestMode: sql<
+        string | null
+      >`COALESCE(${copilotRuns.requestContext}->'recovery'->>'requestMode', ${copilotRuns.requestContext}->'recovery'->'request'->>'mode')`,
+    })
+    .from(copilotRuns)
+    .where(and(eq(copilotRuns.streamId, input.streamId), eq(copilotRuns.userId, input.userId)))
+    .limit(1)
+  if (!run || run.chatId !== input.chatId) return NO_SECRET_AUTHORITY
+
+  if (run.recorded !== null) {
+    const recorded = recordedSecretAuthoritySchema.safeParse(run.recorded)
+    return recorded.success ? recorded.data : NO_SECRET_AUTHORITY
+  }
+  if (run.recoveryKind === 'interactive_stream' && run.requestMode !== 'assistant') {
+    return {
+      secretMountPolicy: { ...DEFAULT_SECRET_MOUNT_POLICY },
+      secretActorUserId: input.userId,
+    }
+  }
+  return NO_SECRET_AUTHORITY
+}
+
 // Un-instrumented: called from a 4 Hz resume poll; per-call spans
 // swamped traces. Use Prom histograms if latency visibility is needed.
 export async function getLatestRunForStream(streamId: string, userId?: string) {
 
@@ -0,0 +1,151 @@
+/**
+ * Re-derives a turn's secret authority from real `copilot_runs` rows in a temporary PostgreSQL
+ * table. Set TEST_DATABASE_URL to a local PostgreSQL database.
+ */
+import { generateId } from '@sim/utils/id'
+import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js'
+import postgres from 'postgres'
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { database, databaseUrl } = await vi.hoisted(async () => {
+  const { readTestDatabaseUrl } = await import('@sim/db/testing/test-infrastructure')
+  return {
+    databaseUrl: readTestDatabaseUrl(),
+    database: { current: undefined as PostgresJsDatabase | undefined },
+  }
+})
+
+vi.mock('@sim/db', () => ({
+  db: {
+    select: (...args: unknown[]) => {
+      if (!database.current) throw new Error('PostgreSQL test database is not initialized')
+      return Reflect.apply(database.current.select, database.current, args)
+    },
+  },
+}))
+vi.mock('@/lib/mothership/request/otel', () => ({ markSpanForError: vi.fn() }))
+
+import { getRunSecretAuthority } from '@/lib/mothership/async-runs/repository'
+import { NO_SECRET_AUTHORITY } from '@/lib/mothership/secret-mount-policy'
+
+const connection = postgres(databaseUrl, { max: 1 })
+const userId = 'user-secret-authority'
+const chatId = generateId()
+
+async function insertRun(streamId: string, requestContext: unknown, owner = userId) {
+  await connection`
+    INSERT INTO copilot_runs (execution_id, chat_id, user_id, stream_id, request_context)
+    VALUES (${generateId()}, ${chatId}, ${owner}, ${streamId},
+      ${JSON.stringify(requestContext)}::jsonb)
+  `
+}
+
+function interactiveContext(mode?: string) {
+  return {
+    controllerToken: 'lease',
+    recovery: {
+      kind: 'interactive_stream',
+      request: { message: 'hi', userId, chatId, ...(mode ? { mode } : {}) },
+      goRoute: '/api/copilot',
+      clientToolPickupExpected: true,
+    },
+  }
+}
+
+afterAll(async () => {
+  await connection.end()
+})
+
+describe('getRunSecretAuthority with PostgreSQL', () => {
+  beforeAll(async () => {
+    database.current = drizzle(connection)
+    await connection.unsafe(`
+      CREATE TEMP TABLE copilot_runs
+        (LIKE public.copilot_runs INCLUDING DEFAULTS INCLUDING CONSTRAINTS INCLUDING INDEXES)
+    `)
+  })
+
+  beforeEach(async () => {
+    await connection.unsafe('TRUNCATE pg_temp.copilot_runs')
+  })
+
+  it("returns a headless run's recorded authority, including a refused actor", async () => {
+    await insertRun('stream-inbox', {
+      source: 'headless_lifecycle',
+      secretAuthority: {
+        secretMountPolicy: { secretScope: 'selected', mountedSecrets: ['STRIPE_KEY'] },
+        secretActorUserId: null,
+      },
+    })
+
+    await expect(
+      getRunSecretAuthority({ streamId: 'stream-inbox', userId, chatId })
+    ).resolves.toEqual({
+      secretMountPolicy: { secretScope: 'selected', mountedSecrets: ['STRIPE_KEY'] },
+      secretActorUserId: null,
+    })
+  })
+
+  it('gives an interactive agent turn every secret, as the turn user', async () => {
+    await insertRun('stream-agent', interactiveContext())
+    await insertRun('stream-build', interactiveContext('build'))
+
+    for (const streamId of ['stream-agent', 'stream-build']) {
+      await expect(getRunSecretAuthority({ streamId, userId, chatId })).resolves.toEqual({
+        secretMountPolicy: { secretScope: 'all', mountedSecrets: [] },
+        secretActorUserId: userId,
+      })
+    }
+  })
+
+  it('gives an interactive assistant turn no secrets', async () => {
+    await insertRun('stream-assistant', interactiveContext('assistant'))
+
+    await expect(
+      getRunSecretAuthority({ streamId: 'stream-assistant', userId, chatId })
+    ).resolves.toEqual(NO_SECRET_AUTHORITY)
+  })
+
+  it('gives a headless run that recorded nothing no secrets', async () => {
+    await insertRun('stream-legacy', { source: 'headless_lifecycle' })
+    await insertRun('stream-empty', {})
+
+    for (const streamId of ['stream-legacy', 'stream-empty']) {
+      await expect(getRunSecretAuthority({ streamId, userId, chatId })).resolves.toEqual(
+        NO_SECRET_AUTHORITY
+      )
+    }
+  })
+
+  it('refuses a malformed recorded authority instead of reading it as the permissive default', async () => {
+    await insertRun('stream-no-scope', {
+      secretAuthority: { secretMountPolicy: {}, secretActorUserId: userId },
+    })
+    await insertRun('stream-bad-actor', {
+      secretAuthority: {
+        secretMountPolicy: { secretScope: 'all', mountedSecrets: [] },
+        secretActorUserId: 42,
+      },
+    })
+
+    for (const streamId of ['stream-no-scope', 'stream-bad-actor']) {
+      await expect(getRunSecretAuthority({ streamId, userId, chatId })).resolves.toEqual(
+        NO_SECRET_AUTHORITY
+      )
+    }
+  })
+
+  it("never lends a run's authority to another user, another chat, or an unknown turn", async () => {
+    await insertRun('stream-owned', interactiveContext())
+
+    const lookups = [
+      { streamId: 'stream-owned', userId: 'someone-else', chatId },
+      { streamId: 'stream-owned', userId, chatId: generateId() },
+      { streamId: 'stream-owned', userId, chatId: 'not-a-uuid' },
+      { streamId: 'stream-missing', userId, chatId },
+    ]
+    for (const lookup of lookups) {
+      await expect(getRunSecretAuthority(lookup)).resolves.toEqual(NO_SECRET_AUTHORITY)
+    }
+  })
+})