feat(resource-policies): add statement evaluator

[TheodoreSpeaks]

Summary

• replace credential group grants with statement-based resource policies supporting explicit allow/deny and bounded IAM-style conditions
• bind persisted execution principals and current workflow authority into credential-use decisions, while keeping actor-owned credential access as a hidden system rule
• add a raw JSON policy editor plus trigger-owned policy lifecycle and a bounded backfill

Type of Change

• New feature

Testing

• bun run lint
• bun run type-check
• bun run check:audits
• bun run check:migrations origin/staging
• 67 database tests and 221 focused application/workflow tests

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 26, 2026 6:23pm

[cursor]

PR Summary

High Risk
Changes authorization for managed OAuth credentials and internal executor delegation, including policy evaluation, deployment-version binding, and token issuance. Mis-evaluation could over- or under-grant credential access.

Overview
Replaces enrollment-only Credential Group token checks with stored IAM-style resource policies (allow/deny, principals, flat conditions) plus a hidden actor-own system rule. Admins can edit the full policy as JSON; credential use is policy-gated while listing stays discovery-only.

Adds a required per-group policy lifecycle (create/delete/backfill), optimistic-concurrency admin GET/PUT, and a settings Access tab. Credential use now evaluates credential_groups.credentials.use with explicit-deny precedence.

Threads current workflow (draft vs active deployment version) through executor delegation and child-workflow execution so workflow principals and sim:WorkflowMode conditions bind to the child, not the root. Deployed state APIs now require deploymentVersionId; stale or cross-workspace child authority fails closed.

^{Reviewed by Cursor Bugbot for commit a01a557. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces credential-group grants with statement-based resource policies and carries workflow authority through credential resolution and execution.

• Adds policy persistence, lifecycle synchronization, bounded backfill, and reconciliation.
• Adds workflow-scoped credential-group access APIs and settings UI.
• Propagates deployment-version and principal context through nested and resumed workflow execution.
• Adds focused authorization, migration, execution, API, and UI tests.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credential-groups/application/authorization.ts	Connects delegated execution principals and workflow authority to credential-group policy evaluation.
apps/sim/lib/credential-groups/application/workflow-access-policy.ts	Defines and evaluates the bounded workflow-access policy representation.
apps/sim/lib/resource-policies/repository.ts	Adds workspace-scoped policy reads and revision-controlled writes.
apps/sim/lib/workflows/executor/execution-core.ts	Carries deployment authority into initial and resumed workflow execution.
apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts	Validates and restores deployment-version context when resuming paused executions.
packages/db/credential-group-resource-policies.ts	Implements credential-group policy lifecycle synchronization, bounded backfill, and invariant validation.
packages/db/migrations/0308_glorious_hellion.sql	Introduces the resource-policy persistence schema and supporting constraints.
apps/sim/ee/credential-groups/components/credential-group-access.tsx	Adds the revision-aware workflow access editor for credential groups.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Workflow execution] --> B[Persisted execution principal]
  B --> C[Current workflow authority]
  C --> D[Credential resolution]
  D --> E[Credential-group resource policy]
  E --> F{Statement evaluation}
  F -->|Allow| G[Managed credential token]
  F -->|No match or deny| H[Access refused]
  I[Workspace administrator] --> J[Workflow access editor]
  J --> K[Policy repository]
  K --> E
  L[Credential-group lifecycle] --> M[Trigger and bounded backfill]
  M --> K

Loading

_{Reviews (7): Last reviewed commit: "Merge remote-tracking branch 'origin/fea..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

3 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eccb03a. Configure here.}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile