@@ -1,4 +1,8 @@
 import { copilotHttpMock, copilotHttpMockFns } from '@sim/testing/mocks/copilot-http.mock'
+import {
+  mothershipAsyncRunsMock,
+  mothershipAsyncRunsMockFns,
+} from '@sim/testing/mocks/mothership-async-runs.mock'
 import {
   mothershipEnvironmentContextMock,
   mothershipEnvironmentContextMockFns,
@@ -16,6 +20,8 @@ vi.mock('@/lib/mothership/request/http', () => copilotHttpMock)
 
 vi.mock('@/lib/mothership/environment-context', () => mothershipEnvironmentContextMock)
 
+vi.mock('@/lib/mothership/async-runs/repository', () => mothershipAsyncRunsMock)
+
 vi.mock('@/lib/mothership/tool-executor', () => ({
   ensureHandlersRegistered: vi.fn(),
   toolRequiresApprovalLane: mockToolRequiresApprovalLane,
@@ -41,6 +47,7 @@ const { mockCheckInternalApiKey } = copilotHttpMockFns
 
 const mockPrepareEnvironmentContext =
   mothershipEnvironmentContextMockFns.mockPrepareCopilotEnvironmentContext
+const { mockGetRunSecretAuthority } = mothershipAsyncRunsMockFns
 
 function makeRequest(body: Record<string, unknown>): Request {
   return new Request('http://localhost/api/copilot/tools/execute', {
@@ -81,7 +88,7 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
     mockPrepareEnvironmentContext.mockRejectedValue(new Error('Workspace ws-gone does not exist'))
     mockHandler.mockResolvedValue({ success: true, output: { content: 'sensitive' } })
 
-    const res = await POST(makeRequest({ ...BASE_BODY, messageId: 'msg-no-registry' }) as never)
+    const res = await POST(makeRequest({ ...BASE_BODY, messageId: 'msg-no-registry' }) as never, {})
     const body = await res.json()
 
     expect(mockHandler).not.toHaveBeenCalled()
@@ -112,7 +119,8 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
         toolName: 'generate_api_key',
         params: { name: 'demo' },
         messageId: 'msg-api-key',
-      }) as never
+      }) as never,
+      {}
     )
     const body = await res.json()
 
@@ -142,7 +150,8 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
           toolName: 'run_function',
           params: { code: 'return 1' },
           messageId: 'msg-gated',
-        }) as never
+        }) as never,
+        {}
       )
       const body = await res.json()
 
@@ -153,4 +162,36 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
       expect(body.error).toContain('checkpoint lane')
     })
   })
+  /**
+   * Go's body cannot carry the turn's secret authority — the turn payload never did — so a
+   * context rebuilt from it alone read as "every secret, as the body's user" for a turn that
+   * was admitted with less.
+   */
+  describe('secret authority', () => {
+    it("hands the tool the turn's re-derived authority, not the permissive default", async () => {
+      const admitted = {
+        secretMountPolicy: { secretScope: 'selected' as const, mountedSecrets: ['STRIPE_KEY'] },
+        secretActorUserId: null,
+      }
+      mockGetRunSecretAuthority.mockResolvedValueOnce(admitted)
+      mockHandler.mockResolvedValue({ success: true, output: { ran: true } })
+
+      await POST(
+        makeRequest({
+          ...BASE_BODY,
+          toolName: 'run_function',
+          params: { code: 'return 1', secrets: ['STRIPE_KEY'] },
+          messageId: 'msg-admitted-authority',
+        }) as never,
+        {}
+      )
+
+      expect(mockGetRunSecretAuthority).toHaveBeenCalledWith({
+        streamId: 'msg-admitted-authority',
+        userId: BASE_BODY.userId,
+        chatId: BASE_BODY.chatId,
+      })
+      expect(mockHandler.mock.calls[0][1]).toMatchObject(admitted)
+    })
+  })
 })
@@ -1,9 +1,11 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { LRUCache } from 'lru-cache'
 import { type NextRequest, NextResponse } from 'next/server'
 import { copilotToolExecuteInternalBodySchema } from '@/lib/api/contracts/copilot'
 import { validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getRunSecretAuthority } from '@/lib/mothership/async-runs/repository'
 import { toolResultForModel } from '@/lib/mothership/chat/sim-key-redaction'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
 import { MothershipStreamV1ToolOutcome } from '@/lib/mothership/generated/mothership-stream-v1'
@@ -19,6 +21,7 @@ import {
 } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { handleResourceSideEffects } from '@/lib/mothership/request/tools/resources'
 import type { ToolCallResult } from '@/lib/mothership/request/types'
+import { NO_SECRET_AUTHORITY, type TurnSecretAuthority } from '@/lib/mothership/secret-mount-policy'
 import { ensureHandlersRegistered, toolRequiresApprovalLane } from '@/lib/mothership/tool-executor'
 import { executeTool } from '@/lib/mothership/tool-executor/executor'
 import { TOOL_EFFECT_PHASE } from '@/lib/mothership/tool-executor/types'
@@ -31,44 +34,38 @@ const logger = createLogger('CopilotToolExecuteInternalAPI')
  * provenance activated by one tool call must stay visible to the next call's
  * egress projection, exactly as the request-lifecycle registry accumulates
  * across a turn. Keyed by the turn (messageId) so one background lane shares
- * one registry; TTL-evicted since nothing signals turn end on this route.
+ * one registry; idle-evicted since nothing signals turn end on this route.
+ *
+ * The turn's secret authority, which Go's body cannot carry, is cached beside it
+ * (see {@link getRunSecretAuthority}).
  */
-const TURN_REGISTRY_TTL_MS = 10 * 60 * 1000
-const TURN_REGISTRY_CACHE_MAX = 256
-const turnRegistryCache = new Map<
+const turnContextCache = new LRUCache<
   string,
-  { registry: ResolvedSecretTraceRegistry; expiresAt: number }
->()
+  { registry: ResolvedSecretTraceRegistry; secretAuthority: TurnSecretAuthority }
+>({ max: 256, ttl: 10 * 60 * 1000, updateAgeOnGet: true })
 
-async function getTurnEgressRegistry(
+async function getTurnToolContext(
   userId: string,
   workspaceId: string | undefined,
+  chatId: string | undefined,
   messageId: string | undefined,
   requestMode?: string,
   organizationId?: string
-): Promise<ResolvedSecretTraceRegistry> {
-  const key = `${userId}\u0000${workspaceId ?? ''}\u0000${organizationId ?? ''}\u0000${messageId ?? ''}\u0000${requestMode ?? ''}`
-  const now = Date.now()
-  const hit = turnRegistryCache.get(key)
-  if (hit && hit.expiresAt > now) {
-    hit.expiresAt = now + TURN_REGISTRY_TTL_MS
-    return hit.registry
-  }
-  const environmentContext = await prepareCopilotEnvironmentContext(userId, workspaceId, {
-    includeSecrets: requestMode !== 'assistant',
-  })
-  for (const [cachedKey, cached] of turnRegistryCache) {
-    if (cached.expiresAt <= now) turnRegistryCache.delete(cachedKey)
-  }
-  if (turnRegistryCache.size >= TURN_REGISTRY_CACHE_MAX) {
-    const oldest = turnRegistryCache.keys().next().value
-    if (oldest !== undefined) turnRegistryCache.delete(oldest)
-  }
-  turnRegistryCache.set(key, {
-    registry: environmentContext.resolvedSecretTraceRegistry,
-    expiresAt: now + TURN_REGISTRY_TTL_MS,
-  })
-  return environmentContext.resolvedSecretTraceRegistry
+): Promise<{ registry: ResolvedSecretTraceRegistry; secretAuthority: TurnSecretAuthority }> {
+  const key = `${userId}\u0000${workspaceId ?? ''}\u0000${organizationId ?? ''}\u0000${chatId ?? ''}\u0000${messageId ?? ''}\u0000${requestMode ?? ''}`
+  const hit = turnContextCache.get(key)
+  if (hit) return hit
+  const [environmentContext, secretAuthority] = await Promise.all([
+    prepareCopilotEnvironmentContext(userId, workspaceId, {
+      includeSecrets: requestMode !== 'assistant',
+    }),
+    chatId && messageId
+      ? getRunSecretAuthority({ streamId: messageId, userId, chatId })
+      : NO_SECRET_AUTHORITY,
+  ])
+  const entry = { registry: environmentContext.resolvedSecretTraceRegistry, secretAuthority }
+  turnContextCache.set(key, entry)
+  return entry
 }
 
 // POST /api/copilot/tools/execute — internal (Go → Sim) in-band execution of
@@ -153,14 +150,18 @@ export const POST = withRouteHandler((request: NextRequest) =>
 
       let toolRegistry: ResolvedSecretTraceRegistry
       let turnRegistry: ResolvedSecretTraceRegistry
+      let secretAuthority: TurnSecretAuthority
       try {
-        turnRegistry = await getTurnEgressRegistry(
+        const turn = await getTurnToolContext(
           userId,
           workspaceId,
+          chatId,
           messageId,
           requestMode,
           organizationId
         )
+        turnRegistry = turn.registry
+        secretAuthority = turn.secretAuthority
         toolRegistry = turnRegistry.forkForInputPaths([])
       } catch (err) {
         /**
@@ -218,6 +219,8 @@ export const POST = withRouteHandler((request: NextRequest) =>
           assistantSearch,
           targetWorkspaceId,
           resolvedSecretTraceRegistry: toolRegistry,
+          secretMountPolicy: secretAuthority.secretMountPolicy,
+          secretActorUserId: secretAuthority.secretActorUserId,
         })
         const projection = inspectToolResultForCopilot(result, toolRegistry, toolName)
         const projected = projection.result
 
@@ -30,6 +30,8 @@ import {
   type SQL,
   sql,
 } from 'drizzle-orm'
+import { z } from 'zod'
+import { secretMountPolicySchema } from '@/lib/api/contracts/secret-mount-policy'
 import { type ResourceOwner, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
@@ -65,6 +67,11 @@ import {
 import type { BillingAdmission } from '@/lib/mothership/request/lifecycle/recovery-config'
 import { markSpanForError } from '@/lib/mothership/request/otel'
 import { sealClientToolSettlement } from '@/lib/mothership/request/tools/client-completion-seal.server'
+import {
+  DEFAULT_SECRET_MOUNT_POLICY,
+  NO_SECRET_AUTHORITY,
+  type TurnSecretAuthority,
+} from '@/lib/mothership/secret-mount-policy'
 import {
   type DesktopToolClaimOwner,
   isDesktopToolCall,
@@ -573,6 +580,49 @@ export async function recordRunBillingAdmission(
   )
 }
 
+const recordedSecretAuthoritySchema = z.object({
+  secretMountPolicy: secretMountPolicySchema,
+  secretActorUserId: z.string().nullable(),
+})
+
+/**
+ * The secret authority a turn was admitted with, for a lane that rebuilds its tool context from
+ * Go's request instead of inheriting the turn's. Headless runs record it at admission; an
+ * interactive chat narrows it only in assistant mode, so its saved request decides. Anything
+ * else — no run, another user's or chat's run, an unrecorded headless run — mounts nothing.
+ */
+export async function getRunSecretAuthority(input: {
+  streamId: string
+  userId: string
+  chatId: string
+}): Promise<TurnSecretAuthority> {
+  const [run] = await db
+    .select({
+      chatId: copilotRuns.chatId,
+      recorded: sql<unknown>`${copilotRuns.requestContext}->'secretAuthority'`,
+      recoveryKind: sql<string | null>`${copilotRuns.requestContext}->'recovery'->>'kind'`,
+      requestMode: sql<
+        string | null
+      >`COALESCE(${copilotRuns.requestContext}->'recovery'->>'requestMode', ${copilotRuns.requestContext}->'recovery'->'request'->>'mode')`,
+    })
+    .from(copilotRuns)
+    .where(and(eq(copilotRuns.streamId, input.streamId), eq(copilotRuns.userId, input.userId)))
+    .limit(1)
+  if (!run || run.chatId !== input.chatId) return NO_SECRET_AUTHORITY
+
+  if (run.recorded !== null) {
+    const recorded = recordedSecretAuthoritySchema.safeParse(run.recorded)
+    return recorded.success ? recorded.data : NO_SECRET_AUTHORITY
+  }
+  if (run.recoveryKind === 'interactive_stream' && run.requestMode !== 'assistant') {
+    return {
+      secretMountPolicy: { ...DEFAULT_SECRET_MOUNT_POLICY },
+      secretActorUserId: input.userId,
+    }
+  }
+  return NO_SECRET_AUTHORITY
+}
+
 // Un-instrumented: called from a 4 Hz resume poll; per-call spans
 // swamped traces. Use Prom histograms if latency visibility is needed.
 export async function getLatestRunForStream(streamId: string, userId?: string) {