feat(resource-policies): add statement evaluator

[TheodoreSpeaks]

Summary

• replace credential group grants with statement-based resource policies supporting explicit allow/deny and bounded IAM-style conditions
• bind persisted execution principals and current workflow authority into credential-use decisions, while keeping actor-owned credential access as a hidden system rule
• add a raw JSON policy editor plus trigger-owned policy lifecycle and a bounded backfill

Type of Change

• New feature

Testing

• bun run lint
• bun run type-check
• bun run check:audits
• bun run check:migrations origin/staging
• 67 database tests and 221 focused application/workflow tests

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 27, 2026 2:09am

[cursor]

PR Summary

High Risk
Changes authorization for managed OAuth credentials and internal executor delegation, including policy evaluation, deployment-version binding, and token issuance. Mis-evaluation could over- or under-grant credential access.

Overview
Replaces enrollment-only Credential Group token checks with stored IAM-style resource policies (allow/deny, principals, flat conditions) plus a hidden actor-own system rule. Admins can edit the full policy as JSON; credential use is policy-gated while listing stays discovery-only.

Adds a required per-group policy lifecycle (create/delete/backfill), optimistic-concurrency admin GET/PUT, and a settings Access tab. Credential use now evaluates credential_groups.credentials.use with explicit-deny precedence.

Threads current workflow (draft vs active deployment version) through executor delegation and child-workflow execution so workflow principals and sim:WorkflowMode conditions bind to the child, not the root. Deployed state APIs now require deploymentVersionId; stale or cross-workspace child authority fails closed.

^{Reviewed by Cursor Bugbot for commit a01a557. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces credential-group grants with statement-based resource policies and carries workflow execution authority into credential-use decisions.

• Adds explicit allow/deny policy evaluation with bounded principals and conditions.
• Adds credential-group workflow-access administration and optimistic revision handling.
• Adds resource-policy persistence, lifecycle triggers, backfill, and reconciliation.
• Propagates deployment identity through nested and resumed workflow execution.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/resource-policies/evaluator.ts	Implements deterministic explicit-deny, allow, and implicit-deny statement evaluation with registered principal and condition handlers.
apps/sim/lib/credential-groups/application/workflow-access-policy.ts	Compiles and evaluates bounded workflow-access policies while retaining actor-owned credential access as a system rule.
apps/sim/lib/credential-groups/application/authorization.ts	Connects delegated execution identity and current workflow authority to credential-group policy decisions.
apps/sim/lib/workflows/executor/execution-core.ts	Constructs current workflow authority from draft or durable deployment state for downstream authorization.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Propagates child workflow identity and deployment version through nested executor delegation.
packages/db/credential-group-resource-policies.ts	Adds idempotent policy reconciliation, lifecycle-trigger installation, bounded backfill paging, and invariant validation.
packages/db/migrations/0309_material_blonde_phantom.sql	Introduces resource-policy persistence with workspace ownership and one-policy-per-resource uniqueness.
apps/sim/ee/credential-groups/components/credential-group-access.tsx	Adds a staged workflow-access editor with optimistic revisions, conflict preservation, and save-time catalog validation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Authenticated principal] --> B[Workspace operation authorization]
  B --> C[Credential group access]
  C --> D[Load resource policy]
  E[Current workflow authority] --> F[Statement evaluator]
  D --> F
  F --> G{Decision}
  G -->|Explicit deny| H[Reject credential use]
  G -->|Allow| I[Resolve credential]
  G -->|Implicit deny| H
  J[Credential group lifecycle] --> K[Policy trigger and backfill]
  K --> D

Loading

_{Reviews (14): Last reviewed commit: "chore(resource-policies): merge workspac..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

3 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eccb03a. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile